@geminixiang/mikan 1.0.0-beta.37 → 1.0.0-beta.39

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAe,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACrF,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAEhC,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAA4B,YAAoB;QAC9C,KAAK,CAAC,mCAAmC,YAAY,EAAE,CAAC,CAAC;4BAD/B,YAAY;QAEtC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAID,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAGrD,MAAM,gBAAgB,GAAuB;IAC3C,GAAG,EAAE;QACH,QAAQ,EAAE,WAAW;QACrB,KAAK,EAAE,mBAAmB;QAC1B,aAAa,EAAE,KAAK;QACpB,SAAS,EAAE;YACT,QAAQ,EAAE,WAAW;YACrB,KAAK,EAAE,kBAAkB;SAC1B;KACF;IACD,KAAK,EAAE;QACL,SAAS,EAAE,WAAW;KACvB;IACD,OAAO,EAAE;QACP,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE;YACL,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,IAAI;SACb;QACD,SAAS,EAAE;YACT,UAAU,EAAE,UAAU;SACvB;QACD,kBAAkB,EAAE,EAAE;KACvB;CACF,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAChB,IAAI,CAAC,MAAM,CAAC;QACV,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACtC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAC1B,IAAI,CAAC,KAAK,CAAC;YACT,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YACtB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;SACpB,CAAC,CACH;QACD,SAAS,EAAE,IAAI,CAAC,QAAQ,CACtB,IAAI,CAAC,MAAM,CAAC;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;SACpC,CAAC,CACH;KACF,CAAC,CACH;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;QACV,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;KAClC,CAAC,CACH;IACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,MAAM,CAAC;QACV,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;KAC1F,CAAC,CACH;IACD,OAAO,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACV,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACpC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,MAAM,CAAC;YACV,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAClC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;SACrC,CAAC,CACH;QACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,MAAM,CAAC;YACV,cAAc,EAAE,IAAI,CAAC,QAAQ,CAC3B,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAC5D;SACF,CAAC,CACH;QACD,SAAS,EAAE,IAAI,CAAC,QAAQ,CACtB,IAAI,CAAC,MAAM,CAAC;YACV,UAAU,EAAE,IAAI,CAAC,QAAQ,CACvB,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAChE;YACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,KAAK,CAAC;gBACT,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;gBAC5B,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;gBAC9B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;aACrB,CAAC,CACH;SACF,CAAC,CACH;QACD,kBAAkB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;KACjD,CAAC,CACH;IACD,SAAS,EAAE,IAAI,CAAC,QAAQ,CACtB,IAAI,CAAC,MAAM,CAAC;QACV,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACtC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KAChD,CAAC,CACH;IACD,0DAA0D;IAC1D,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;CACnD,CAAC,CAAC;AAIH,SAAS,gBAAgB,CAAC,YAAoB;IAC5C,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAEzD,CAAC;YACF,IAAI,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CACb,oGAAoG,CACrG,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,EAAE,CAAC;gBAClF,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,0BAA0B,CAAC,YAAY,EAAE,kBAAkB,EAAE,CAAC,MAAM,EAAE,EAAE,CAC7E,MAAM,KAAK,uBAAuB;QAChC,CAAC,CAAC,8BAA8B,YAAY,2CAA2C;QACvF,CAAC,CAAC,8BAA8B,YAAY,KAAK,MAAM,EAAE,CAC5D,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA0B;IACzD,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,wBAAwB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3F,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,iBAAiB,CAAC,QAAkB;IAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC5C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,OAAwB;IACxD,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IAC9D,MAAM,eAAe,GACnB,OAAO,CAAC,KAAK,EAAE,cAAc,KAAK,SAAS;QACzC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAkB,EAAE,MAAM,EAAE,gBAAyB,EAAE;QACvE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,KAAK,MAAM;YACxC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAkB,EAAE,MAAM,EAAE,MAAe,EAAE;YAC7D,CAAC,CAAC,SAAS,CAAC;IAClB,MAAM,SAAS,GAAG,eAAe;QAC/B,CAAC,CAAC,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE;QAC9C,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACtB,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAC3B,IAAiC,EACjC,QAAqC;IAErC,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC3B,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO;QACL,GAAG,IAAI;QACP,GAAG,QAAQ;QACX,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS;YACtC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE;YAC7D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,eAAe,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,0BAA0B,CAAC,YAAY,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB,EAAE,IAAY;IAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,oCAAoC,IAAI,oDAAoD,CAC7F,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAgC;IAC5D,OAAO,aAAa,CAAC,KAAK,EAAE,mBAAmB,CAAkB,CAAC;AACpE,CAAC;AAED,SAAS,aAAa,CAAC,QAA8B;IACnD,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,oBAAoB,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAEnC,OAAO;QACL,QAAQ;QACR,KAAK;QACL,aAAa;QACb,SAAS;QACT,OAAO;QACP,KAAK;QACL,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO,uBAAuB,CAAC,qBAAqB,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,aAAa,CAAC,qBAAqB,EAAE,CAAC,CAAC;AAChD,CAAC;AAaD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAgC;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC,CAAC;IACrF,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,kBAAkB,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAC;QAC3D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAChE,IAAI,OAAO,GAAG,MAAM,CAAC;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,kBAAkB,CAAC,UAAU,EAAE,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC5C,qEAAqE;QACrE,yDAAyD;QACzD,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7B,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,CAAC,UAAU,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,kDAAkD,UAAU,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9F,CAAC;QACD,GAAG,CAAC,OAAO,CAAC,qDAAqD,QAAQ,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,KAAa;IACrD,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wCAAwC,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAgC;IAC1E,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAC7C,MAAM,kBAAkB,GAAG,uBAAuB,CAChD,gBAAgB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CACxD,CAAC;IACF,yEAAyE;IACzE,8EAA8E;IAC9E,MAAM,OAAO,GAAG,oBAAoB,CAAC,YAAY,CAAC,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACvF,OAAO,aAAa,CAAC;QACnB,GAAG,YAAY;QACf,GAAG,kBAAkB;QACrB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,0EAA0E;QAC1E,uEAAuE;QACvE,qEAAqE;QACrE,0EAA0E;QAC1E,uEAAuE;QACvE,uBAAuB;QACvB,QAAQ,EAAE,kBAAkB,CAAC,QAAQ;KACtC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAiC;IACvE,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,MAAM,MAAM,GAA8B,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IAC1E,MAAM,KAAK,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC;IACpE,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,IAAI,MAAM,EAAE,QAAQ,EAAE,wBAAwB,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,IAAI,MAAM,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACjF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,eAAe,GAAG,YAAY,CAAC;AACrC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAEvD,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B,CAAC,eAAuB;IACrE,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC3D,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,sBAAsB,CAAC,WAAW,CAAC,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IACrE,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,CAAC,YAAY,CAAC,EAAE,CAAC;IACzE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAC7C,eAAuB,EACvB,MAAuB;IAEvB,eAAe,CAAC,eAAe,CAAC,CAAC;IAEjC,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC;IAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;IAE9D,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACpC,CAAC;IAED,sBAAsB,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,MAAc;IACxD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,SAAS,KAAK,UAAU,IAAI,SAAS,CAAC,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAC5C,QAAgB,EAChB,UAAkB,EAClB,WAAmB;IAEnB,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC;QAAE,OAAO;IAChD,MAAM,OAAO,GACX,gBAAgB,QAAQ,+CAA+C,UAAU,KAAK;QACtF,0EAA0E;QAC1E,qEAAqE,CAAC;IACxE,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,UAAU,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,6EAA6E;AAC7E,SAAS,aAAa,CAAC,QAA4B;IACjD,OAAO,QAAQ,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACpF,OAAO,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,YAAY,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1B,sBAAsB,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAChF,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,MAA2C;IAClE,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,qBAAqB,CAAC,MAA0B;IACvD,OAAO;QACL,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,uEAAuE;QACvE,2EAA2E;QAC3E,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxE,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAA4B,EAC5B,MAA4B;IAE5B,MAAM,OAAO,GAAuB;QAClC,GAAG,QAAQ;QACX,GAAG,EAAE;YACH,GAAG,QAAQ,CAAC,GAAG;YACf,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvF;QACD,MAAM,EAAE;YACN,GAAG,QAAQ,CAAC,MAAM;YAClB,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE;QACD,0EAA0E;QAC1E,6EAA6E;QAC7E,mEAAmE;QACnE,OAAO,EAAE,oBAAoB,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE;QACrE,KAAK,EAAE;YACL,GAAG,QAAQ,CAAC,KAAK;YACjB,GAAG,MAAM,CAAC,KAAK;SAChB;QACD,0EAA0E;QAC1E,wDAAwD;QACxD,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3F,CAAC;IACF,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,yBAAyB,CAChC,YAAoB,EACpB,eAAmC;IAEnC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,eAAe,CAAC;IACtD,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,yBAAyB,CAAC;YAC1D,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE,+CAA+C,CAAC;YAC5F,CAAC,CAAC,MAAM,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,YAAoB,EACpB,KAA2B,EAC3B,eAAmC;IAEnC,MAAM,QAAQ,GAAG,yBAAyB,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IAC1E,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACvC,sBAAsB,CACpB,YAAY,EACZ,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAA2B;IAC9D,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,eAAe,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,KAAgC,EAChC,KAA2B;IAE3B,kBAAkB,CAAC,wBAAwB,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;AACjE,CAAC;AAOD;;;GAGG;AACH,MAAM,UAAU,iCAAiC,CAC/C,KAAgC;IAEhC,MAAM,IAAI,GAAG,gBAAgB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;IAC9B,IAAI,OAAO,EAAE,SAAS,EAAE,UAAU,KAAK,UAAU;QAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;IACrF,IAAI,OAAO,EAAE,SAAS,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO;YACL,UAAU,EAAE,SAAS;YACrB,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB;SACxE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,EAAE,KAAK,EAAE,cAAc,KAAK,MAAM;QAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAChG,IAAI,OAAO,EAAE,KAAK,EAAE,cAAc,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,KAAgC,EAChC,MAAoC;IAEpC,oBAAoB,CAAC,wBAAwB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAoC;IAC3E,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;AACvF,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,YAAoB,EACpB,MAAoC,EACpC,eAAmC;IAEnC,MAAM,QAAQ,GAAG,yBAAyB,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IAC1E,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;IAC5E,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;IACvF,MAAM,OAAO,GAAoB;QAC/B,GAAG,WAAW;QACd,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzC,CAAC;IACF,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACvC,sBAAsB,CACpB,YAAY,EACZ,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CACzE,CAAC;AACJ,CAAC","sourcesContent":["import type { ThinkingLevel } from \"@earendil-works/pi-agent-core\";\nimport { Type, type Static } from \"@sinclair/typebox\";\nimport { existsSync, lstatSync, readFileSync, renameSync, rmSync } from \"fs\";\nimport { dirname, join, resolve } from \"path\";\nimport { effectiveStateDir } from \"./cli/arg-grammar.js\";\nimport { readEnv } from \"./utils/env.js\";\nimport { ensureDirExists, readJsonSchemaFileIfExists } from \"./utils/file-guards.js\";\nimport { atomicWritePrivateFile } from \"./utils/fs-atomic.js\";\nimport * as log from \"./log.js\";\n\nexport class MissingGlobalSettingsError extends Error {\n  constructor(public readonly settingsPath: string) {\n    super(`Missing global settings file at ${settingsPath}`);\n    this.name = \"MissingGlobalSettingsError\";\n  }\n}\n\nexport type { AgentConfig, AutoReplyConfig, JudgeModelConfig, SandboxSettings } from \"./types.js\";\nimport type { AgentConfig, AutoReplyConfig, JudgeModelConfig, SandboxSettings } from \"./types.js\";\nimport { officeStateDir } from \"./office-address.js\";\nimport type { OfficeAddress } from \"./types.js\";\n\nconst ONBOARD_SETTINGS: SettingsFileConfig = {\n  llm: {\n    provider: \"anthropic\",\n    model: \"claude-sonnet-4-6\",\n    thinkingLevel: \"off\",\n    autoReply: {\n      provider: \"anthropic\",\n      model: \"claude-haiku-4-5\",\n    },\n  },\n  slack: {\n    replyMode: \"top-level\",\n  },\n  sandbox: {\n    cpus: \"0.5\",\n    memory: \"1g\",\n    boost: {\n      cpus: \"2\",\n      memory: \"4g\",\n    },\n    workspace: {\n      doorPolicy: \"isolated\",\n    },\n    defaultSharedVault: \"\",\n  },\n};\n\nconst SettingsFileSchema = Type.Object({\n  llm: Type.Optional(\n    Type.Object({\n      provider: Type.Optional(Type.String()),\n      model: Type.Optional(Type.String()),\n      thinkingLevel: Type.Optional(\n        Type.Union([\n          Type.Literal(\"off\"),\n          Type.Literal(\"minimal\"),\n          Type.Literal(\"low\"),\n          Type.Literal(\"medium\"),\n          Type.Literal(\"high\"),\n          Type.Literal(\"xhigh\"),\n          Type.Literal(\"max\"),\n        ]),\n      ),\n      autoReply: Type.Optional(\n        Type.Object({\n          provider: Type.Optional(Type.String()),\n          model: Type.Optional(Type.String()),\n        }),\n      ),\n    }),\n  ),\n  sentry: Type.Optional(\n    Type.Object({\n      dsn: Type.Optional(Type.String()),\n    }),\n  ),\n  slack: Type.Optional(\n    Type.Object({\n      replyMode: Type.Optional(Type.Union([Type.Literal(\"top-level\"), Type.Literal(\"thread\")])),\n    }),\n  ),\n  sandbox: Type.Optional(\n    Type.Object({\n      cpus: Type.Optional(Type.String()),\n      memory: Type.Optional(Type.String()),\n      boost: Type.Optional(\n        Type.Object({\n          cpus: Type.Optional(Type.String()),\n          memory: Type.Optional(Type.String()),\n        }),\n      ),\n      image: Type.Optional(\n        Type.Object({\n          workspaceMount: Type.Optional(\n            Type.Union([Type.Literal(\"private\"), Type.Literal(\"full\")]),\n          ),\n        }),\n      ),\n      workspace: Type.Optional(\n        Type.Object({\n          doorPolicy: Type.Optional(\n            Type.Union([Type.Literal(\"isolated\"), Type.Literal(\"trusted\")]),\n          ),\n          layout: Type.Optional(\n            Type.Union([\n              Type.Literal(\"conversation\"),\n              Type.Literal(\"shared-support\"),\n              Type.Literal(\"full\"),\n            ]),\n          ),\n        }),\n      ),\n      defaultSharedVault: Type.Optional(Type.String()),\n    }),\n  ),\n  autoReply: Type.Optional(\n    Type.Object({\n      enabled: Type.Optional(Type.Boolean()),\n      rules: Type.Optional(Type.Array(Type.String())),\n    }),\n  ),\n  /** Package sources for this scope; see `src/packages`. */\n  packages: Type.Optional(Type.Array(Type.String())),\n});\n\ntype SettingsFileConfig = Static<typeof SettingsFileSchema>;\n\nfunction loadSettingsFile(settingsPath: string): SettingsFileConfig | undefined {\n  if (existsSync(settingsPath)) {\n    try {\n      const raw = JSON.parse(readFileSync(settingsPath, \"utf-8\")) as {\n        sandbox?: { gondolin?: { remote?: unknown } };\n      };\n      if (raw?.sandbox?.gondolin?.remote !== undefined) {\n        throw new Error(\n          \"sandbox.gondolin.remote is no longer supported; use gondolin:default and remove the remote setting\",\n        );\n      }\n    } catch (error) {\n      if (error instanceof Error && error.message.startsWith(\"sandbox.gondolin.remote\")) {\n        throw error;\n      }\n    }\n  }\n  return readJsonSchemaFileIfExists(settingsPath, SettingsFileSchema, (detail) =>\n    detail === \"unexpected JSON shape\"\n      ? `Malformed settings file at ${settingsPath}: expected a JSON object at the top level`\n      : `Malformed settings file at ${settingsPath}: ${detail}`,\n  );\n}\n\nfunction getStateDir(): string {\n  return effectiveStateDir();\n}\n\nfunction normalizeSettingsConfig(config: SettingsFileConfig): Partial<AgentConfig> {\n  return {\n    ...(config.llm?.provider !== undefined ? { provider: config.llm.provider } : {}),\n    ...(config.llm?.model !== undefined ? { model: config.llm.model } : {}),\n    ...(config.llm?.thinkingLevel !== undefined ? { thinkingLevel: config.llm.thinkingLevel } : {}),\n    ...(config.sentry?.dsn !== undefined ? { sentryDsn: config.sentry.dsn } : {}),\n    ...(config.sandbox !== undefined ? { sandbox: normalizeSandboxSettings(config.sandbox) } : {}),\n    ...(config.slack !== undefined ? { slack: config.slack } : {}),\n    ...(config.packages !== undefined ? { packages: normalizePackages(config.packages) } : {}),\n  };\n}\n\n/** Drop blank entries and duplicates while preserving the author's order. */\nfunction normalizePackages(packages: string[]): string[] {\n  const seen = new Set<string>();\n  const normalized: string[] = [];\n  for (const entry of packages) {\n    const trimmed = entry.trim();\n    if (!trimmed || seen.has(trimmed)) continue;\n    seen.add(trimmed);\n    normalized.push(trimmed);\n  }\n  return normalized;\n}\n\n/**\n * File shape → in-memory shape for the sandbox group. An empty or\n * whitespace-only `defaultSharedVault` means \"no default\" and is dropped;\n * non-empty values are trimmed. Everything else passes through as-is.\n */\nfunction normalizeSandboxSettings(sandbox: SandboxSettings): SandboxSettings {\n  const defaultSharedVault = sandbox.defaultSharedVault?.trim();\n  const legacyWorkspace =\n    sandbox.image?.workspaceMount === \"private\"\n      ? { doorPolicy: \"trusted\" as const, layout: \"shared-support\" as const }\n      : sandbox.image?.workspaceMount === \"full\"\n        ? { doorPolicy: \"trusted\" as const, layout: \"full\" as const }\n        : undefined;\n  const workspace = legacyWorkspace\n    ? { ...legacyWorkspace, ...sandbox.workspace }\n    : sandbox.workspace;\n  return {\n    ...(sandbox.cpus !== undefined ? { cpus: sandbox.cpus } : {}),\n    ...(sandbox.memory !== undefined ? { memory: sandbox.memory } : {}),\n    ...(sandbox.boost !== undefined ? { boost: sandbox.boost } : {}),\n    ...(sandbox.image !== undefined ? { image: sandbox.image } : {}),\n    ...(workspace !== undefined ? { workspace } : {}),\n    ...(defaultSharedVault ? { defaultSharedVault } : {}),\n  };\n}\n\n/**\n * Merge two sandbox settings groups. The merge invariant is LEAF-LEVEL:\n * an override that only sets `sandbox.memory` keeps the base `sandbox.cpus`,\n * and an override that only sets `boost.memory` keeps the base `boost.cpus`\n * (same for `image`). This mirrors how the fields merged when they were\n * flat top-level keys; a group-level spread would silently drop base leaves.\n */\nfunction mergeSandboxSettings(\n  base: SandboxSettings | undefined,\n  override: SandboxSettings | undefined,\n): SandboxSettings | undefined {\n  if (!base) return override;\n  if (!override) return base;\n  return {\n    ...base,\n    ...override,\n    ...(base.boost || override.boost ? { boost: { ...base.boost, ...override.boost } } : {}),\n    ...(base.image || override.image ? { image: { ...base.image, ...override.image } } : {}),\n    ...(base.workspace || override.workspace\n      ? { workspace: { ...base.workspace, ...override.workspace } }\n      : {}),\n  };\n}\n\nfunction getSettingsPath(): string {\n  return join(getStateDir(), \"settings.json\");\n}\n\nfunction requireGlobalSettings(): SettingsFileConfig {\n  const settingsPath = getSettingsPath();\n  const config = loadSettingsFile(settingsPath);\n  if (!config) {\n    throw new MissingGlobalSettingsError(settingsPath);\n  }\n  return config;\n}\n\nfunction requireString(value: string | undefined, path: string): string {\n  if (!value) {\n    throw new Error(\n      `Missing required global setting: ${path}. Run \\`mikan --onboard\\` to create settings.json.`,\n    );\n  }\n  return value;\n}\n\nfunction requireThinkingLevel(value: ThinkingLevel | undefined): ThinkingLevel {\n  return requireString(value, \"llm.thinkingLevel\") as ThinkingLevel;\n}\n\nfunction toAgentConfig(fromFile: Partial<AgentConfig>): AgentConfig {\n  const provider = requireString(fromFile.provider, \"llm.provider\");\n  const model = requireString(fromFile.model, \"llm.model\");\n  const thinkingLevel = requireThinkingLevel(fromFile.thinkingLevel);\n  const sentryDsn = sentryDsnFrom(fromFile.sentryDsn);\n  const sandbox = fromFile.sandbox;\n  const slack = fromFile.slack;\n  const packages = fromFile.packages;\n\n  return {\n    provider,\n    model,\n    thinkingLevel,\n    sentryDsn,\n    sandbox,\n    slack,\n    packages,\n  };\n}\n\nfunction loadRawGlobalSettings(): Partial<AgentConfig> {\n  return normalizeSettingsConfig(requireGlobalSettings());\n}\n\nexport function loadGlobalSettings(): AgentConfig {\n  return toAgentConfig(loadRawGlobalSettings());\n}\n\n/**\n * Explicit identity for conversation-settings access. The state-dir key is\n * the office key derived from the address; the workspace directory is only\n * the legacy pre-host-migration settings location. Callers name both — the\n * key is never inferred from the directory basename.\n */\nexport interface ConversationSettingsScope {\n  address: OfficeAddress;\n  conversationDir: string;\n}\n\n/**\n * Host-authoritative location of a conversation's settings file:\n * `<stateDir>/conversations/<conversationId>/settings.json`.\n *\n * Conversation settings used to live at `<conversationDir>/settings.json`,\n * but conversation dirs are bind-mounted read-write into sandbox containers\n * in image mode — code inside the sandbox could edit its own settings.json\n * and flip `sandbox.image.workspaceMount` to \"full\", remounting the entire\n * workspace into its container (cross-conversation access). Settings are an\n * administrator surface, so they live under the host-only state dir.\n *\n * Migration: on first access per conversation, a legacy\n * `<conversationDir>/settings.json` is moved here. The new file's existence\n * (an empty `{}` is written when there is nothing to migrate) is the\n * migration marker — a legacy file (re)appearing later, e.g. planted from\n * inside the sandbox, is never read again.\n */\nexport function conversationSettingsPath(scope: ConversationSettingsScope): string {\n  const hostPath = join(officeStateDir(getStateDir(), scope.address), \"settings.json\");\n  if (existsSync(hostPath)) {\n    assertSettingsFile(hostPath, \"Host conversation settings\");\n    return hostPath;\n  }\n\n  ensureDirExists(dirname(hostPath));\n  const legacyPath = join(scope.conversationDir, \"settings.json\");\n  let content = \"{}\\n\";\n  let migrated = false;\n  if (existsSync(legacyPath)) {\n    assertSettingsFile(legacyPath, \"Legacy conversation settings\");\n    content = readFileSync(legacyPath, \"utf-8\");\n    // Validate before moving the file. A malformed legacy file must fail\n    // closed and remain available for an operator to repair.\n    loadSettingsFile(legacyPath);\n    migrated = true;\n  }\n  atomicWritePrivateFile(hostPath, content);\n  if (migrated) {\n    try {\n      rmSync(legacyPath);\n    } catch (err) {\n      log.logWarning(`Could not remove legacy conversation settings: ${legacyPath}`, String(err));\n    }\n    log.logInfo(`Migrated conversation settings to host-only path: ${hostPath}`);\n  }\n  return hostPath;\n}\n\nfunction assertSettingsFile(path: string, label: string): void {\n  let stats;\n  try {\n    stats = lstatSync(path);\n  } catch (err) {\n    throw new Error(`${label} cannot be inspected: ${path}`, { cause: err });\n  }\n  if (stats.isSymbolicLink() || !stats.isFile()) {\n    throw new Error(`${label} must be a regular non-symlink file: ${path}`);\n  }\n}\n\nexport function resolveConversationSettings(scope: ConversationSettingsScope): AgentConfig {\n  const globalConfig = loadRawGlobalSettings();\n  const conversationConfig = normalizeSettingsConfig(\n    loadSettingsFile(conversationSettingsPath(scope)) ?? {},\n  );\n  // The sandbox group merges at the leaf level (see mergeSandboxSettings):\n  // a conversation that only sets sandbox.memory keeps the global sandbox.cpus.\n  const sandbox = mergeSandboxSettings(globalConfig.sandbox, conversationConfig.sandbox);\n  return toAgentConfig({\n    ...globalConfig,\n    ...conversationConfig,\n    ...(sandbox ? { sandbox } : {}),\n    // Packages are additive across scopes, so the spread above would be wrong\n    // twice over: an unset conversation list would read as the global list\n    // (loading every global package a second time under the conversation\n    // scope), and a set one would read as if it had replaced the global list.\n    // Report only this conversation's entries; resolveConversationPackages\n    // combines the scopes.\n    packages: conversationConfig.packages,\n  });\n}\n\n/**\n * Resolve the model used to judge auto-reply rules. Falls back to the main\n * llm.{provider,model} when llm.autoReply is not set, so a missing override\n * keeps current behavior.\n *\n * @deprecated Auto-reply is kept for compatibility while its future is undecided.\n */\nexport function loadAutoReplyJudgeModel(scope?: ConversationSettingsScope): JudgeModelConfig {\n  const global = requireGlobalSettings();\n  const local = scope ? (loadSettingsFile(conversationSettingsPath(scope)) ?? {}) : {};\n  const merged: SettingsFileConfig[\"llm\"] = { ...global.llm, ...local.llm };\n  const judge = { ...global.llm?.autoReply, ...local.llm?.autoReply };\n  const provider = requireString(judge.provider ?? merged?.provider, \"llm.autoReply.provider\");\n  const model = requireString(judge.model ?? merged?.model, \"llm.autoReply.model\");\n  return { provider, model };\n}\n\nconst AUTO_REPLY_FILE = \"auto-reply\";\nconst AUTO_REPLY_DISABLED_FILE = \"auto-reply.disabled\";\n\nfunction readAutoReplyRulesFile(path: string): string[] {\n  const text = readFileSync(path, \"utf-8\").trim();\n  return text ? [text] : [];\n}\n\n/**\n * Load the mom-compatible auto-reply marker file state for a conversation.\n *\n * - `auto-reply` exists: enabled; empty file means reply to any top-level message.\n * - `auto-reply.disabled` exists: disabled, preserving any rules text for re-enable.\n * - neither exists: disabled.\n *\n * @deprecated Auto-reply is kept for compatibility while its future is undecided.\n */\nexport function loadConversationAutoReplyConfig(conversationDir: string): AutoReplyConfig {\n  const enabledPath = join(conversationDir, AUTO_REPLY_FILE);\n  if (existsSync(enabledPath)) {\n    return { enabled: true, rules: readAutoReplyRulesFile(enabledPath) };\n  }\n\n  const disabledPath = join(conversationDir, AUTO_REPLY_DISABLED_FILE);\n  if (existsSync(disabledPath)) {\n    return { enabled: false, rules: readAutoReplyRulesFile(disabledPath) };\n  }\n\n  return { enabled: false, rules: [] };\n}\n\n/**\n * Save auto-reply state using mom-compatible marker files.\n *\n * @deprecated Auto-reply is kept for compatibility while its future is undecided.\n */\nexport function saveConversationAutoReplyConfig(\n  conversationDir: string,\n  config: AutoReplyConfig,\n): void {\n  ensureDirExists(conversationDir);\n\n  const enabledPath = join(conversationDir, AUTO_REPLY_FILE);\n  const disabledPath = join(conversationDir, AUTO_REPLY_DISABLED_FILE);\n  const targetPath = config.enabled ? enabledPath : disabledPath;\n  const otherPath = config.enabled ? disabledPath : enabledPath;\n\n  if (existsSync(otherPath)) {\n    renameSync(otherPath, targetPath);\n  }\n\n  atomicWritePrivateFile(targetPath, config.rules.join(\"\\n\"));\n}\n\n/**\n * True when `child` is `parent` or a path inside it. Purely lexical (no\n * symlink resolution) — used for configuration sanity checks, not as the\n * final security boundary.\n */\nexport function isPathInside(child: string, parent: string): boolean {\n  const parentPath = resolve(parent);\n  const childPath = resolve(child);\n  return childPath === parentPath || childPath.startsWith(parentPath + \"/\");\n}\n\n/**\n * The state dir (extensions code, extension data, vaults, auth.json) must\n * never live inside the working dir: conversation opt-in \"full\" mode mounts\n * the entire working dir read-write into sandbox containers, and a mounted\n * state dir would let sandboxed code plant extension modules that the host\n * process later imports — a sandbox escape. Fatal under sandboxed modes;\n * host mode has no mounts, so only warn about the bad hygiene.\n */\nexport function assertStateDirOutsideWorkspace(\n  stateDir: string,\n  workingDir: string,\n  sandboxType: string,\n): void {\n  if (!isPathInside(stateDir, workingDir)) return;\n  const message =\n    `--state-dir (${stateDir}) must not be inside the working directory (${workingDir}): ` +\n    `sandbox containers mount the working directory, and a mounted state dir ` +\n    `would expose extensions, vaults, and credentials to sandboxed code.`;\n  if (sandboxType === \"host\") {\n    log.logWarning(\"Insecure state dir location\", message);\n    return;\n  }\n  throw new Error(message);\n}\n\n/** Settings-file DSN wins over SENTRY_DSN env — the rule lives only here. */\nfunction sentryDsnFrom(fromFile: string | undefined): string | undefined {\n  return fromFile || readEnv(\"SENTRY_DSN\");\n}\n\nexport function resolveSentryDsn(): string | undefined {\n  const fromFile = normalizeSettingsConfig(loadSettingsFile(getSettingsPath()) ?? {});\n  return sentryDsnFrom(fromFile.sentryDsn);\n}\n\nexport function createGlobalSettingsFile(stateDir: string): string {\n  const settingsPath = join(stateDir, \"settings.json\");\n  if (existsSync(settingsPath)) {\n    throw new Error(`Global settings already exists at ${settingsPath}`);\n  }\n  ensureDirExists(stateDir);\n  atomicWritePrivateFile(settingsPath, JSON.stringify(ONBOARD_SETTINGS, null, 2));\n  return settingsPath;\n}\n\n/**\n * Externally-visible base URL of the link/OAuth server, e.g.\n * `https://mikan.example.com` (no trailing slash). Read from `LINK_URL` or\n * `MIKAN_LINK_URL`, the same env var the bot uses to build credential onboarding links.\n */\nexport function resolveLinkBaseUrl(): string | undefined {\n  const raw = readEnv(\"LINK_URL\");\n  if (!raw) return undefined;\n  return raw.replace(/\\/+$/, \"\");\n}\n\nfunction hasDefinedValue(values: Record<string, unknown> | undefined): boolean {\n  return values !== undefined && Object.values(values).some((value) => value !== undefined);\n}\n\nfunction compactSettingsConfig(config: SettingsFileConfig): SettingsFileConfig {\n  return {\n    ...(hasDefinedValue(config.llm) ? { llm: config.llm } : {}),\n    ...(hasDefinedValue(config.sentry) ? { sentry: config.sentry } : {}),\n    ...(hasDefinedValue(config.sandbox) ? { sandbox: config.sandbox } : {}),\n    ...(hasDefinedValue(config.autoReply) ? { autoReply: config.autoReply } : {}),\n    ...(hasDefinedValue(config.slack) ? { slack: config.slack } : {}),\n    // An empty list is meaningful (the admin removed the last package) and\n    // must survive the round trip, so this checks for the key, not for values.\n    ...(config.packages !== undefined ? { packages: config.packages } : {}),\n  };\n}\n\nfunction patchSettingsConfig(\n  existing: SettingsFileConfig,\n  config: Partial<AgentConfig>,\n): SettingsFileConfig {\n  const patched: SettingsFileConfig = {\n    ...existing,\n    llm: {\n      ...existing.llm,\n      ...(config.provider !== undefined ? { provider: config.provider } : {}),\n      ...(config.model !== undefined ? { model: config.model } : {}),\n      ...(config.thinkingLevel !== undefined ? { thinkingLevel: config.thinkingLevel } : {}),\n    },\n    sentry: {\n      ...existing.sentry,\n      ...(config.sentryDsn !== undefined ? { dsn: config.sentryDsn } : {}),\n    },\n    // Leaf-level merge: a patch that only sets sandbox.boost.memory keeps the\n    // existing boost.cpus (and every other existing leaf). compactSettingsConfig\n    // drops the group entirely when it ends up with no defined values.\n    sandbox: mergeSandboxSettings(existing.sandbox, config.sandbox) ?? {},\n    slack: {\n      ...existing.slack,\n      ...config.slack,\n    },\n    // The package list is replaced wholesale, not merged: the portal edits it\n    // as a list, and a merge would make removal impossible.\n    ...(config.packages !== undefined ? { packages: normalizePackages(config.packages) } : {}),\n  };\n  return compactSettingsConfig(patched);\n}\n\nfunction loadSettingsFileForUpdate(\n  settingsPath: string,\n  defaultSettings: SettingsFileConfig,\n): SettingsFileConfig {\n  if (!existsSync(settingsPath)) return defaultSettings;\n  try {\n    return loadSettingsFile(settingsPath) ?? {};\n  } catch (err) {\n    const detail = err instanceof Error ? err.message : String(err);\n    const message = detail.startsWith(\"Malformed settings file\")\n      ? detail.replace(\"Malformed settings file\", \"Refusing to overwrite malformed settings file\")\n      : detail;\n    throw new Error(message, { cause: err });\n  }\n}\n\nfunction updateSettingsFile(\n  settingsPath: string,\n  patch: Partial<AgentConfig>,\n  defaultSettings: SettingsFileConfig,\n): void {\n  const existing = loadSettingsFileForUpdate(settingsPath, defaultSettings);\n  ensureDirExists(dirname(settingsPath));\n  atomicWritePrivateFile(\n    settingsPath,\n    JSON.stringify(patchSettingsConfig(existing, patch), null, 2),\n  );\n}\n\nexport function updateGlobalSettings(patch: Partial<AgentConfig>): void {\n  updateSettingsFile(join(getStateDir(), \"settings.json\"), patch, ONBOARD_SETTINGS);\n}\n\nexport function updateConversationSettings(\n  scope: ConversationSettingsScope,\n  patch: Partial<AgentConfig>,\n): void {\n  updateSettingsFile(conversationSettingsPath(scope), patch, {});\n}\n\n/** An explicit office door-policy selection; `layout` only exists behind a trusted door. */\nexport type WorkspacePolicyChoice =\n  | { doorPolicy: \"isolated\" }\n  | { doorPolicy: \"trusted\"; layout: \"shared-support\" | \"full\" };\n\n/**\n * The conversation's own door-policy override (legacy `image.workspaceMount`\n * included), or null when the office follows the global default.\n */\nexport function loadConversationWorkspaceOverride(\n  scope: ConversationSettingsScope,\n): WorkspacePolicyChoice | null {\n  const file = loadSettingsFile(conversationSettingsPath(scope));\n  const sandbox = file?.sandbox;\n  if (sandbox?.workspace?.doorPolicy === \"isolated\") return { doorPolicy: \"isolated\" };\n  if (sandbox?.workspace?.doorPolicy === \"trusted\") {\n    return {\n      doorPolicy: \"trusted\",\n      layout: sandbox.workspace.layout === \"full\" ? \"full\" : \"shared-support\",\n    };\n  }\n  if (sandbox?.image?.workspaceMount === \"full\") return { doorPolicy: \"trusted\", layout: \"full\" };\n  if (sandbox?.image?.workspaceMount === \"private\") {\n    return { doorPolicy: \"trusted\", layout: \"shared-support\" };\n  }\n  return null;\n}\n\nexport function setConversationWorkspacePolicy(\n  scope: ConversationSettingsScope,\n  choice: WorkspacePolicyChoice | null,\n): void {\n  writeWorkspacePolicy(conversationSettingsPath(scope), choice, {});\n}\n\nexport function setGlobalWorkspacePolicy(choice: WorkspacePolicyChoice | null): void {\n  writeWorkspacePolicy(join(getStateDir(), \"settings.json\"), choice, ONBOARD_SETTINGS);\n}\n\n/**\n * The generic settings patch merges leaves and cannot remove keys, so the\n * door-policy writer edits the file shape directly: it always drops the\n * legacy `image.workspaceMount` (the explicit choice replaces it) and either\n * sets or removes the `workspace` group.\n */\nfunction writeWorkspacePolicy(\n  settingsPath: string,\n  choice: WorkspacePolicyChoice | null,\n  defaultSettings: SettingsFileConfig,\n): void {\n  const existing = loadSettingsFileForUpdate(settingsPath, defaultSettings);\n  const { workspaceMount: _legacy, ...image } = existing.sandbox?.image ?? {};\n  const { workspace: _previous, image: _image, ...sandboxRest } = existing.sandbox ?? {};\n  const sandbox: SandboxSettings = {\n    ...sandboxRest,\n    ...(hasDefinedValue(image) ? { image } : {}),\n    ...(choice ? { workspace: choice } : {}),\n  };\n  ensureDirExists(dirname(settingsPath));\n  atomicWritePrivateFile(\n    settingsPath,\n    JSON.stringify(compactSettingsConfig({ ...existing, sandbox }), null, 2),\n  );\n}\n"]}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAe,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACrF,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAEhC,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAA4B,YAAoB;QAC9C,KAAK,CAAC,mCAAmC,YAAY,EAAE,CAAC,CAAC;4BAD/B,YAAY;QAEtC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAMD,MAAM,gBAAgB,GAAuB;IAC3C,GAAG,EAAE;QACH,QAAQ,EAAE,WAAW;QACrB,KAAK,EAAE,mBAAmB;QAC1B,aAAa,EAAE,KAAK;QACpB,SAAS,EAAE;YACT,QAAQ,EAAE,WAAW;YACrB,KAAK,EAAE,kBAAkB;SAC1B;KACF;IACD,KAAK,EAAE;QACL,SAAS,EAAE,WAAW;KACvB;IACD,OAAO,EAAE;QACP,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE;YACL,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,IAAI;SACb;QACD,SAAS,EAAE;YACT,UAAU,EAAE,UAAU;SACvB;QACD,kBAAkB,EAAE,EAAE;KACvB;CACF,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAChB,IAAI,CAAC,MAAM,CAAC;QACV,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACtC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAC1B,IAAI,CAAC,KAAK,CAAC;YACT,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YACtB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;SACpB,CAAC,CACH;QACD,SAAS,EAAE,IAAI,CAAC,QAAQ,CACtB,IAAI,CAAC,MAAM,CAAC;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;SACpC,CAAC,CACH;KACF,CAAC,CACH;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;QACV,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;KAClC,CAAC,CACH;IACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,MAAM,CAAC;QACV,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;KAC1F,CAAC,CACH;IACD,OAAO,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACV,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACpC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,MAAM,CAAC;YACV,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAClC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;SACrC,CAAC,CACH;QACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,MAAM,CAAC;YACV,cAAc,EAAE,IAAI,CAAC,QAAQ,CAC3B,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAC5D;SACF,CAAC,CACH;QACD,SAAS,EAAE,IAAI,CAAC,QAAQ,CACtB,IAAI,CAAC,MAAM,CAAC;YACV,UAAU,EAAE,IAAI,CAAC,QAAQ,CACvB,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAChE;YACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,KAAK,CAAC;gBACT,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;gBAC5B,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;gBAC9B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;aACrB,CAAC,CACH;SACF,CAAC,CACH;QACD,kBAAkB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;KACjD,CAAC,CACH;IACD,SAAS,EAAE,IAAI,CAAC,QAAQ,CACtB,IAAI,CAAC,MAAM,CAAC;QACV,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACtC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KAChD,CAAC,CACH;IACD,0DAA0D;IAC1D,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;CACnD,CAAC,CAAC;AAIH,SAAS,gBAAgB,CAAC,YAAoB;IAC5C,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAEzD,CAAC;YACF,IAAI,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CACb,oGAAoG,CACrG,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,EAAE,CAAC;gBAClF,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,0BAA0B,CAAC,YAAY,EAAE,kBAAkB,EAAE,CAAC,MAAM,EAAE,EAAE,CAC7E,MAAM,KAAK,uBAAuB;QAChC,CAAC,CAAC,8BAA8B,YAAY,2CAA2C;QACvF,CAAC,CAAC,8BAA8B,YAAY,KAAK,MAAM,EAAE,CAC5D,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA0B;IACzD,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,wBAAwB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3F,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,iBAAiB,CAAC,QAAkB;IAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC5C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,OAAwB;IACxD,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IAC9D,MAAM,eAAe,GACnB,OAAO,CAAC,KAAK,EAAE,cAAc,KAAK,SAAS;QACzC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAkB,EAAE,MAAM,EAAE,gBAAyB,EAAE;QACvE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,KAAK,MAAM;YACxC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAkB,EAAE,MAAM,EAAE,MAAe,EAAE;YAC7D,CAAC,CAAC,SAAS,CAAC;IAClB,MAAM,SAAS,GAAG,eAAe;QAC/B,CAAC,CAAC,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE;QAC9C,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACtB,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAC3B,IAAiC,EACjC,QAAqC;IAErC,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC3B,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO;QACL,GAAG,IAAI;QACP,GAAG,QAAQ;QACX,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS;YACtC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE;YAC7D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,eAAe,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,0BAA0B,CAAC,YAAY,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB,EAAE,IAAY;IAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,oCAAoC,IAAI,oDAAoD,CAC7F,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAgC;IAC5D,OAAO,aAAa,CAAC,KAAK,EAAE,mBAAmB,CAAkB,CAAC;AACpE,CAAC;AAED,SAAS,aAAa,CAAC,QAA8B;IACnD,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,oBAAoB,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAEnC,OAAO;QACL,QAAQ;QACR,KAAK;QACL,aAAa;QACb,SAAS;QACT,OAAO;QACP,KAAK;QACL,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO,uBAAuB,CAAC,qBAAqB,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,aAAa,CAAC,qBAAqB,EAAE,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACxD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,kBAAkB,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAC;QAC3D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACrD,IAAI,OAAO,GAAG,MAAM,CAAC;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,kBAAkB,CAAC,UAAU,EAAE,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC5C,qEAAqE;QACrE,yDAAyD;QACzD,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7B,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,CAAC,UAAU,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,kDAAkD,UAAU,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9F,CAAC;QACD,GAAG,CAAC,OAAO,CAAC,qDAAqD,QAAQ,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,KAAa;IACrD,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wCAAwC,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACxD,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAC7C,MAAM,kBAAkB,GAAG,uBAAuB,CAChD,gBAAgB,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CACzD,CAAC;IACF,yEAAyE;IACzE,8EAA8E;IAC9E,MAAM,OAAO,GAAG,oBAAoB,CAAC,YAAY,CAAC,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACvF,OAAO,aAAa,CAAC;QACnB,GAAG,YAAY;QACf,GAAG,kBAAkB;QACrB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,0EAA0E;QAC1E,uEAAuE;QACvE,qEAAqE;QACrE,0EAA0E;QAC1E,uEAAuE;QACvE,uBAAuB;QACvB,QAAQ,EAAE,kBAAkB,CAAC,QAAQ;KACtC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAe;IACrD,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,MAAM,MAAM,GAA8B,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IAC1E,MAAM,KAAK,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC;IACpE,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,IAAI,MAAM,EAAE,QAAQ,EAAE,wBAAwB,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,IAAI,MAAM,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACjF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,eAAe,GAAG,YAAY,CAAC;AACrC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAEvD,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B,CAAC,eAAuB;IACrE,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC3D,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,sBAAsB,CAAC,WAAW,CAAC,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IACrE,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,CAAC,YAAY,CAAC,EAAE,CAAC;IACzE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAC7C,eAAuB,EACvB,MAAuB;IAEvB,eAAe,CAAC,eAAe,CAAC,CAAC;IAEjC,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC;IAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;IAE9D,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACpC,CAAC;IAED,sBAAsB,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,MAAc;IACxD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,SAAS,KAAK,UAAU,IAAI,SAAS,CAAC,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAC5C,QAAgB,EAChB,UAAkB,EAClB,WAAmB;IAEnB,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC;QAAE,OAAO;IAChD,MAAM,OAAO,GACX,gBAAgB,QAAQ,+CAA+C,UAAU,KAAK;QACtF,0EAA0E;QAC1E,qEAAqE,CAAC;IACxE,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,UAAU,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,6EAA6E;AAC7E,SAAS,aAAa,CAAC,QAA4B;IACjD,OAAO,QAAQ,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACpF,OAAO,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,YAAY,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1B,sBAAsB,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAChF,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,MAA2C;IAClE,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,qBAAqB,CAAC,MAA0B;IACvD,OAAO;QACL,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,uEAAuE;QACvE,2EAA2E;QAC3E,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxE,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAA4B,EAC5B,MAA4B;IAE5B,MAAM,OAAO,GAAuB;QAClC,GAAG,QAAQ;QACX,GAAG,EAAE;YACH,GAAG,QAAQ,CAAC,GAAG;YACf,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvF;QACD,MAAM,EAAE;YACN,GAAG,QAAQ,CAAC,MAAM;YAClB,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE;QACD,0EAA0E;QAC1E,6EAA6E;QAC7E,mEAAmE;QACnE,OAAO,EAAE,oBAAoB,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE;QACrE,KAAK,EAAE;YACL,GAAG,QAAQ,CAAC,KAAK;YACjB,GAAG,MAAM,CAAC,KAAK;SAChB;QACD,0EAA0E;QAC1E,wDAAwD;QACxD,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3F,CAAC;IACF,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,yBAAyB,CAChC,YAAoB,EACpB,eAAmC;IAEnC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,eAAe,CAAC;IACtD,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,yBAAyB,CAAC;YAC1D,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE,+CAA+C,CAAC;YAC5F,CAAC,CAAC,MAAM,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,YAAoB,EACpB,KAA2B,EAC3B,eAAmC;IAEnC,MAAM,QAAQ,GAAG,yBAAyB,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IAC1E,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACvC,sBAAsB,CACpB,YAAY,EACZ,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAA2B;IAC9D,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,eAAe,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,MAAc,EAAE,KAA2B;IACpF,kBAAkB,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;AAClE,CAAC;AAOD;;;GAGG;AACH,MAAM,UAAU,iCAAiC,CAAC,MAAc;IAC9D,MAAM,IAAI,GAAG,gBAAgB,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;IAC9B,IAAI,OAAO,EAAE,SAAS,EAAE,UAAU,KAAK,UAAU;QAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;IACrF,IAAI,OAAO,EAAE,SAAS,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO;YACL,UAAU,EAAE,SAAS;YACrB,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB;SACxE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,EAAE,KAAK,EAAE,cAAc,KAAK,MAAM;QAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAChG,IAAI,OAAO,EAAE,KAAK,EAAE,cAAc,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAAc,EACd,MAAoC;IAEpC,oBAAoB,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAoC;IAC3E,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;AACvF,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,YAAoB,EACpB,MAAoC,EACpC,eAAmC;IAEnC,MAAM,QAAQ,GAAG,yBAAyB,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IAC1E,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;IAC5E,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;IACvF,MAAM,OAAO,GAAoB;QAC/B,GAAG,WAAW;QACd,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzC,CAAC;IACF,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACvC,sBAAsB,CACpB,YAAY,EACZ,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CACzE,CAAC;AACJ,CAAC","sourcesContent":["import type { ThinkingLevel } from \"@earendil-works/pi-agent-core\";\nimport { Type, type Static } from \"@sinclair/typebox\";\nimport { existsSync, lstatSync, readFileSync, renameSync, rmSync } from \"fs\";\nimport { dirname, join, resolve } from \"path\";\nimport { effectiveStateDir } from \"./cli/arg-grammar.js\";\nimport { readEnv } from \"./utils/env.js\";\nimport { ensureDirExists, readJsonSchemaFileIfExists } from \"./utils/file-guards.js\";\nimport { atomicWritePrivateFile } from \"./utils/fs-atomic.js\";\nimport * as log from \"./log.js\";\n\nexport class MissingGlobalSettingsError extends Error {\n  constructor(public readonly settingsPath: string) {\n    super(`Missing global settings file at ${settingsPath}`);\n    this.name = \"MissingGlobalSettingsError\";\n  }\n}\n\nexport type { AgentConfig, AutoReplyConfig, JudgeModelConfig, SandboxSettings } from \"./types.js\";\nimport type { AgentConfig, AutoReplyConfig, JudgeModelConfig, SandboxSettings } from \"./types.js\";\nimport type { Office } from \"./office/index.js\";\n\nconst ONBOARD_SETTINGS: SettingsFileConfig = {\n  llm: {\n    provider: \"anthropic\",\n    model: \"claude-sonnet-4-6\",\n    thinkingLevel: \"off\",\n    autoReply: {\n      provider: \"anthropic\",\n      model: \"claude-haiku-4-5\",\n    },\n  },\n  slack: {\n    replyMode: \"top-level\",\n  },\n  sandbox: {\n    cpus: \"0.5\",\n    memory: \"1g\",\n    boost: {\n      cpus: \"2\",\n      memory: \"4g\",\n    },\n    workspace: {\n      doorPolicy: \"isolated\",\n    },\n    defaultSharedVault: \"\",\n  },\n};\n\nconst SettingsFileSchema = Type.Object({\n  llm: Type.Optional(\n    Type.Object({\n      provider: Type.Optional(Type.String()),\n      model: Type.Optional(Type.String()),\n      thinkingLevel: Type.Optional(\n        Type.Union([\n          Type.Literal(\"off\"),\n          Type.Literal(\"minimal\"),\n          Type.Literal(\"low\"),\n          Type.Literal(\"medium\"),\n          Type.Literal(\"high\"),\n          Type.Literal(\"xhigh\"),\n          Type.Literal(\"max\"),\n        ]),\n      ),\n      autoReply: Type.Optional(\n        Type.Object({\n          provider: Type.Optional(Type.String()),\n          model: Type.Optional(Type.String()),\n        }),\n      ),\n    }),\n  ),\n  sentry: Type.Optional(\n    Type.Object({\n      dsn: Type.Optional(Type.String()),\n    }),\n  ),\n  slack: Type.Optional(\n    Type.Object({\n      replyMode: Type.Optional(Type.Union([Type.Literal(\"top-level\"), Type.Literal(\"thread\")])),\n    }),\n  ),\n  sandbox: Type.Optional(\n    Type.Object({\n      cpus: Type.Optional(Type.String()),\n      memory: Type.Optional(Type.String()),\n      boost: Type.Optional(\n        Type.Object({\n          cpus: Type.Optional(Type.String()),\n          memory: Type.Optional(Type.String()),\n        }),\n      ),\n      image: Type.Optional(\n        Type.Object({\n          workspaceMount: Type.Optional(\n            Type.Union([Type.Literal(\"private\"), Type.Literal(\"full\")]),\n          ),\n        }),\n      ),\n      workspace: Type.Optional(\n        Type.Object({\n          doorPolicy: Type.Optional(\n            Type.Union([Type.Literal(\"isolated\"), Type.Literal(\"trusted\")]),\n          ),\n          layout: Type.Optional(\n            Type.Union([\n              Type.Literal(\"conversation\"),\n              Type.Literal(\"shared-support\"),\n              Type.Literal(\"full\"),\n            ]),\n          ),\n        }),\n      ),\n      defaultSharedVault: Type.Optional(Type.String()),\n    }),\n  ),\n  autoReply: Type.Optional(\n    Type.Object({\n      enabled: Type.Optional(Type.Boolean()),\n      rules: Type.Optional(Type.Array(Type.String())),\n    }),\n  ),\n  /** Package sources for this scope; see `src/packages`. */\n  packages: Type.Optional(Type.Array(Type.String())),\n});\n\ntype SettingsFileConfig = Static<typeof SettingsFileSchema>;\n\nfunction loadSettingsFile(settingsPath: string): SettingsFileConfig | undefined {\n  if (existsSync(settingsPath)) {\n    try {\n      const raw = JSON.parse(readFileSync(settingsPath, \"utf-8\")) as {\n        sandbox?: { gondolin?: { remote?: unknown } };\n      };\n      if (raw?.sandbox?.gondolin?.remote !== undefined) {\n        throw new Error(\n          \"sandbox.gondolin.remote is no longer supported; use gondolin:default and remove the remote setting\",\n        );\n      }\n    } catch (error) {\n      if (error instanceof Error && error.message.startsWith(\"sandbox.gondolin.remote\")) {\n        throw error;\n      }\n    }\n  }\n  return readJsonSchemaFileIfExists(settingsPath, SettingsFileSchema, (detail) =>\n    detail === \"unexpected JSON shape\"\n      ? `Malformed settings file at ${settingsPath}: expected a JSON object at the top level`\n      : `Malformed settings file at ${settingsPath}: ${detail}`,\n  );\n}\n\nfunction getStateDir(): string {\n  return effectiveStateDir();\n}\n\nfunction normalizeSettingsConfig(config: SettingsFileConfig): Partial<AgentConfig> {\n  return {\n    ...(config.llm?.provider !== undefined ? { provider: config.llm.provider } : {}),\n    ...(config.llm?.model !== undefined ? { model: config.llm.model } : {}),\n    ...(config.llm?.thinkingLevel !== undefined ? { thinkingLevel: config.llm.thinkingLevel } : {}),\n    ...(config.sentry?.dsn !== undefined ? { sentryDsn: config.sentry.dsn } : {}),\n    ...(config.sandbox !== undefined ? { sandbox: normalizeSandboxSettings(config.sandbox) } : {}),\n    ...(config.slack !== undefined ? { slack: config.slack } : {}),\n    ...(config.packages !== undefined ? { packages: normalizePackages(config.packages) } : {}),\n  };\n}\n\n/** Drop blank entries and duplicates while preserving the author's order. */\nfunction normalizePackages(packages: string[]): string[] {\n  const seen = new Set<string>();\n  const normalized: string[] = [];\n  for (const entry of packages) {\n    const trimmed = entry.trim();\n    if (!trimmed || seen.has(trimmed)) continue;\n    seen.add(trimmed);\n    normalized.push(trimmed);\n  }\n  return normalized;\n}\n\n/**\n * File shape → in-memory shape for the sandbox group. An empty or\n * whitespace-only `defaultSharedVault` means \"no default\" and is dropped;\n * non-empty values are trimmed. Everything else passes through as-is.\n */\nfunction normalizeSandboxSettings(sandbox: SandboxSettings): SandboxSettings {\n  const defaultSharedVault = sandbox.defaultSharedVault?.trim();\n  const legacyWorkspace =\n    sandbox.image?.workspaceMount === \"private\"\n      ? { doorPolicy: \"trusted\" as const, layout: \"shared-support\" as const }\n      : sandbox.image?.workspaceMount === \"full\"\n        ? { doorPolicy: \"trusted\" as const, layout: \"full\" as const }\n        : undefined;\n  const workspace = legacyWorkspace\n    ? { ...legacyWorkspace, ...sandbox.workspace }\n    : sandbox.workspace;\n  return {\n    ...(sandbox.cpus !== undefined ? { cpus: sandbox.cpus } : {}),\n    ...(sandbox.memory !== undefined ? { memory: sandbox.memory } : {}),\n    ...(sandbox.boost !== undefined ? { boost: sandbox.boost } : {}),\n    ...(sandbox.image !== undefined ? { image: sandbox.image } : {}),\n    ...(workspace !== undefined ? { workspace } : {}),\n    ...(defaultSharedVault ? { defaultSharedVault } : {}),\n  };\n}\n\n/**\n * Merge two sandbox settings groups. The merge invariant is LEAF-LEVEL:\n * an override that only sets `sandbox.memory` keeps the base `sandbox.cpus`,\n * and an override that only sets `boost.memory` keeps the base `boost.cpus`\n * (same for `image`). This mirrors how the fields merged when they were\n * flat top-level keys; a group-level spread would silently drop base leaves.\n */\nfunction mergeSandboxSettings(\n  base: SandboxSettings | undefined,\n  override: SandboxSettings | undefined,\n): SandboxSettings | undefined {\n  if (!base) return override;\n  if (!override) return base;\n  return {\n    ...base,\n    ...override,\n    ...(base.boost || override.boost ? { boost: { ...base.boost, ...override.boost } } : {}),\n    ...(base.image || override.image ? { image: { ...base.image, ...override.image } } : {}),\n    ...(base.workspace || override.workspace\n      ? { workspace: { ...base.workspace, ...override.workspace } }\n      : {}),\n  };\n}\n\nfunction getSettingsPath(): string {\n  return join(getStateDir(), \"settings.json\");\n}\n\nfunction requireGlobalSettings(): SettingsFileConfig {\n  const settingsPath = getSettingsPath();\n  const config = loadSettingsFile(settingsPath);\n  if (!config) {\n    throw new MissingGlobalSettingsError(settingsPath);\n  }\n  return config;\n}\n\nfunction requireString(value: string | undefined, path: string): string {\n  if (!value) {\n    throw new Error(\n      `Missing required global setting: ${path}. Run \\`mikan --onboard\\` to create settings.json.`,\n    );\n  }\n  return value;\n}\n\nfunction requireThinkingLevel(value: ThinkingLevel | undefined): ThinkingLevel {\n  return requireString(value, \"llm.thinkingLevel\") as ThinkingLevel;\n}\n\nfunction toAgentConfig(fromFile: Partial<AgentConfig>): AgentConfig {\n  const provider = requireString(fromFile.provider, \"llm.provider\");\n  const model = requireString(fromFile.model, \"llm.model\");\n  const thinkingLevel = requireThinkingLevel(fromFile.thinkingLevel);\n  const sentryDsn = sentryDsnFrom(fromFile.sentryDsn);\n  const sandbox = fromFile.sandbox;\n  const slack = fromFile.slack;\n  const packages = fromFile.packages;\n\n  return {\n    provider,\n    model,\n    thinkingLevel,\n    sentryDsn,\n    sandbox,\n    slack,\n    packages,\n  };\n}\n\nfunction loadRawGlobalSettings(): Partial<AgentConfig> {\n  return normalizeSettingsConfig(requireGlobalSettings());\n}\n\nexport function loadGlobalSettings(): AgentConfig {\n  return toAgentConfig(loadRawGlobalSettings());\n}\n\n/**\n * Host-authoritative location of a conversation's settings file:\n * `<office state dir>/settings.json`. The Office value names both the\n * state-dir key and the legacy pre-host-migration location (its workspace\n * dir) — the key is never inferred from a directory basename.\n *\n * Conversation settings used to live at `<conversationDir>/settings.json`,\n * but conversation dirs are bind-mounted read-write into sandbox containers\n * in image mode — code inside the sandbox could edit its own settings.json\n * and flip `sandbox.image.workspaceMount` to \"full\", remounting the entire\n * workspace into its container (cross-conversation access). Settings are an\n * administrator surface, so they live under the host-only state dir.\n *\n * Migration: on first access per conversation, a legacy\n * `<conversationDir>/settings.json` is moved here. The new file's existence\n * (an empty `{}` is written when there is nothing to migrate) is the\n * migration marker — a legacy file (re)appearing later, e.g. planted from\n * inside the sandbox, is never read again.\n */\nexport function conversationSettingsPath(office: Office): string {\n  const hostPath = join(office.stateDir, \"settings.json\");\n  if (existsSync(hostPath)) {\n    assertSettingsFile(hostPath, \"Host conversation settings\");\n    return hostPath;\n  }\n\n  ensureDirExists(dirname(hostPath));\n  const legacyPath = join(office.dir, \"settings.json\");\n  let content = \"{}\\n\";\n  let migrated = false;\n  if (existsSync(legacyPath)) {\n    assertSettingsFile(legacyPath, \"Legacy conversation settings\");\n    content = readFileSync(legacyPath, \"utf-8\");\n    // Validate before moving the file. A malformed legacy file must fail\n    // closed and remain available for an operator to repair.\n    loadSettingsFile(legacyPath);\n    migrated = true;\n  }\n  atomicWritePrivateFile(hostPath, content);\n  if (migrated) {\n    try {\n      rmSync(legacyPath);\n    } catch (err) {\n      log.logWarning(`Could not remove legacy conversation settings: ${legacyPath}`, String(err));\n    }\n    log.logInfo(`Migrated conversation settings to host-only path: ${hostPath}`);\n  }\n  return hostPath;\n}\n\nfunction assertSettingsFile(path: string, label: string): void {\n  let stats;\n  try {\n    stats = lstatSync(path);\n  } catch (err) {\n    throw new Error(`${label} cannot be inspected: ${path}`, { cause: err });\n  }\n  if (stats.isSymbolicLink() || !stats.isFile()) {\n    throw new Error(`${label} must be a regular non-symlink file: ${path}`);\n  }\n}\n\nexport function resolveConversationSettings(office: Office): AgentConfig {\n  const globalConfig = loadRawGlobalSettings();\n  const conversationConfig = normalizeSettingsConfig(\n    loadSettingsFile(conversationSettingsPath(office)) ?? {},\n  );\n  // The sandbox group merges at the leaf level (see mergeSandboxSettings):\n  // a conversation that only sets sandbox.memory keeps the global sandbox.cpus.\n  const sandbox = mergeSandboxSettings(globalConfig.sandbox, conversationConfig.sandbox);\n  return toAgentConfig({\n    ...globalConfig,\n    ...conversationConfig,\n    ...(sandbox ? { sandbox } : {}),\n    // Packages are additive across scopes, so the spread above would be wrong\n    // twice over: an unset conversation list would read as the global list\n    // (loading every global package a second time under the conversation\n    // scope), and a set one would read as if it had replaced the global list.\n    // Report only this conversation's entries; resolveConversationPackages\n    // combines the scopes.\n    packages: conversationConfig.packages,\n  });\n}\n\n/**\n * Resolve the model used to judge auto-reply rules. Falls back to the main\n * llm.{provider,model} when llm.autoReply is not set, so a missing override\n * keeps current behavior.\n *\n * @deprecated Auto-reply is kept for compatibility while its future is undecided.\n */\nexport function loadAutoReplyJudgeModel(office?: Office): JudgeModelConfig {\n  const global = requireGlobalSettings();\n  const local = office ? (loadSettingsFile(conversationSettingsPath(office)) ?? {}) : {};\n  const merged: SettingsFileConfig[\"llm\"] = { ...global.llm, ...local.llm };\n  const judge = { ...global.llm?.autoReply, ...local.llm?.autoReply };\n  const provider = requireString(judge.provider ?? merged?.provider, \"llm.autoReply.provider\");\n  const model = requireString(judge.model ?? merged?.model, \"llm.autoReply.model\");\n  return { provider, model };\n}\n\nconst AUTO_REPLY_FILE = \"auto-reply\";\nconst AUTO_REPLY_DISABLED_FILE = \"auto-reply.disabled\";\n\nfunction readAutoReplyRulesFile(path: string): string[] {\n  const text = readFileSync(path, \"utf-8\").trim();\n  return text ? [text] : [];\n}\n\n/**\n * Load the mom-compatible auto-reply marker file state for a conversation.\n *\n * - `auto-reply` exists: enabled; empty file means reply to any top-level message.\n * - `auto-reply.disabled` exists: disabled, preserving any rules text for re-enable.\n * - neither exists: disabled.\n *\n * @deprecated Auto-reply is kept for compatibility while its future is undecided.\n */\nexport function loadConversationAutoReplyConfig(conversationDir: string): AutoReplyConfig {\n  const enabledPath = join(conversationDir, AUTO_REPLY_FILE);\n  if (existsSync(enabledPath)) {\n    return { enabled: true, rules: readAutoReplyRulesFile(enabledPath) };\n  }\n\n  const disabledPath = join(conversationDir, AUTO_REPLY_DISABLED_FILE);\n  if (existsSync(disabledPath)) {\n    return { enabled: false, rules: readAutoReplyRulesFile(disabledPath) };\n  }\n\n  return { enabled: false, rules: [] };\n}\n\n/**\n * Save auto-reply state using mom-compatible marker files.\n *\n * @deprecated Auto-reply is kept for compatibility while its future is undecided.\n */\nexport function saveConversationAutoReplyConfig(\n  conversationDir: string,\n  config: AutoReplyConfig,\n): void {\n  ensureDirExists(conversationDir);\n\n  const enabledPath = join(conversationDir, AUTO_REPLY_FILE);\n  const disabledPath = join(conversationDir, AUTO_REPLY_DISABLED_FILE);\n  const targetPath = config.enabled ? enabledPath : disabledPath;\n  const otherPath = config.enabled ? disabledPath : enabledPath;\n\n  if (existsSync(otherPath)) {\n    renameSync(otherPath, targetPath);\n  }\n\n  atomicWritePrivateFile(targetPath, config.rules.join(\"\\n\"));\n}\n\n/**\n * True when `child` is `parent` or a path inside it. Purely lexical (no\n * symlink resolution) — used for configuration sanity checks, not as the\n * final security boundary.\n */\nexport function isPathInside(child: string, parent: string): boolean {\n  const parentPath = resolve(parent);\n  const childPath = resolve(child);\n  return childPath === parentPath || childPath.startsWith(parentPath + \"/\");\n}\n\n/**\n * The state dir (extensions code, extension data, vaults, auth.json) must\n * never live inside the working dir: conversation opt-in \"full\" mode mounts\n * the entire working dir read-write into sandbox containers, and a mounted\n * state dir would let sandboxed code plant extension modules that the host\n * process later imports — a sandbox escape. Fatal under sandboxed modes;\n * host mode has no mounts, so only warn about the bad hygiene.\n */\nexport function assertStateDirOutsideWorkspace(\n  stateDir: string,\n  workingDir: string,\n  sandboxType: string,\n): void {\n  if (!isPathInside(stateDir, workingDir)) return;\n  const message =\n    `--state-dir (${stateDir}) must not be inside the working directory (${workingDir}): ` +\n    `sandbox containers mount the working directory, and a mounted state dir ` +\n    `would expose extensions, vaults, and credentials to sandboxed code.`;\n  if (sandboxType === \"host\") {\n    log.logWarning(\"Insecure state dir location\", message);\n    return;\n  }\n  throw new Error(message);\n}\n\n/** Settings-file DSN wins over SENTRY_DSN env — the rule lives only here. */\nfunction sentryDsnFrom(fromFile: string | undefined): string | undefined {\n  return fromFile || readEnv(\"SENTRY_DSN\");\n}\n\nexport function resolveSentryDsn(): string | undefined {\n  const fromFile = normalizeSettingsConfig(loadSettingsFile(getSettingsPath()) ?? {});\n  return sentryDsnFrom(fromFile.sentryDsn);\n}\n\nexport function createGlobalSettingsFile(stateDir: string): string {\n  const settingsPath = join(stateDir, \"settings.json\");\n  if (existsSync(settingsPath)) {\n    throw new Error(`Global settings already exists at ${settingsPath}`);\n  }\n  ensureDirExists(stateDir);\n  atomicWritePrivateFile(settingsPath, JSON.stringify(ONBOARD_SETTINGS, null, 2));\n  return settingsPath;\n}\n\n/**\n * Externally-visible base URL of the link/OAuth server, e.g.\n * `https://mikan.example.com` (no trailing slash). Read from `LINK_URL` or\n * `MIKAN_LINK_URL`, the same env var the bot uses to build credential onboarding links.\n */\nexport function resolveLinkBaseUrl(): string | undefined {\n  const raw = readEnv(\"LINK_URL\");\n  if (!raw) return undefined;\n  return raw.replace(/\\/+$/, \"\");\n}\n\nfunction hasDefinedValue(values: Record<string, unknown> | undefined): boolean {\n  return values !== undefined && Object.values(values).some((value) => value !== undefined);\n}\n\nfunction compactSettingsConfig(config: SettingsFileConfig): SettingsFileConfig {\n  return {\n    ...(hasDefinedValue(config.llm) ? { llm: config.llm } : {}),\n    ...(hasDefinedValue(config.sentry) ? { sentry: config.sentry } : {}),\n    ...(hasDefinedValue(config.sandbox) ? { sandbox: config.sandbox } : {}),\n    ...(hasDefinedValue(config.autoReply) ? { autoReply: config.autoReply } : {}),\n    ...(hasDefinedValue(config.slack) ? { slack: config.slack } : {}),\n    // An empty list is meaningful (the admin removed the last package) and\n    // must survive the round trip, so this checks for the key, not for values.\n    ...(config.packages !== undefined ? { packages: config.packages } : {}),\n  };\n}\n\nfunction patchSettingsConfig(\n  existing: SettingsFileConfig,\n  config: Partial<AgentConfig>,\n): SettingsFileConfig {\n  const patched: SettingsFileConfig = {\n    ...existing,\n    llm: {\n      ...existing.llm,\n      ...(config.provider !== undefined ? { provider: config.provider } : {}),\n      ...(config.model !== undefined ? { model: config.model } : {}),\n      ...(config.thinkingLevel !== undefined ? { thinkingLevel: config.thinkingLevel } : {}),\n    },\n    sentry: {\n      ...existing.sentry,\n      ...(config.sentryDsn !== undefined ? { dsn: config.sentryDsn } : {}),\n    },\n    // Leaf-level merge: a patch that only sets sandbox.boost.memory keeps the\n    // existing boost.cpus (and every other existing leaf). compactSettingsConfig\n    // drops the group entirely when it ends up with no defined values.\n    sandbox: mergeSandboxSettings(existing.sandbox, config.sandbox) ?? {},\n    slack: {\n      ...existing.slack,\n      ...config.slack,\n    },\n    // The package list is replaced wholesale, not merged: the portal edits it\n    // as a list, and a merge would make removal impossible.\n    ...(config.packages !== undefined ? { packages: normalizePackages(config.packages) } : {}),\n  };\n  return compactSettingsConfig(patched);\n}\n\nfunction loadSettingsFileForUpdate(\n  settingsPath: string,\n  defaultSettings: SettingsFileConfig,\n): SettingsFileConfig {\n  if (!existsSync(settingsPath)) return defaultSettings;\n  try {\n    return loadSettingsFile(settingsPath) ?? {};\n  } catch (err) {\n    const detail = err instanceof Error ? err.message : String(err);\n    const message = detail.startsWith(\"Malformed settings file\")\n      ? detail.replace(\"Malformed settings file\", \"Refusing to overwrite malformed settings file\")\n      : detail;\n    throw new Error(message, { cause: err });\n  }\n}\n\nfunction updateSettingsFile(\n  settingsPath: string,\n  patch: Partial<AgentConfig>,\n  defaultSettings: SettingsFileConfig,\n): void {\n  const existing = loadSettingsFileForUpdate(settingsPath, defaultSettings);\n  ensureDirExists(dirname(settingsPath));\n  atomicWritePrivateFile(\n    settingsPath,\n    JSON.stringify(patchSettingsConfig(existing, patch), null, 2),\n  );\n}\n\nexport function updateGlobalSettings(patch: Partial<AgentConfig>): void {\n  updateSettingsFile(join(getStateDir(), \"settings.json\"), patch, ONBOARD_SETTINGS);\n}\n\nexport function updateConversationSettings(office: Office, patch: Partial<AgentConfig>): void {\n  updateSettingsFile(conversationSettingsPath(office), patch, {});\n}\n\n/** An explicit office door-policy selection; `layout` only exists behind a trusted door. */\nexport type WorkspacePolicyChoice =\n  | { doorPolicy: \"isolated\" }\n  | { doorPolicy: \"trusted\"; layout: \"shared-support\" | \"full\" };\n\n/**\n * The conversation's own door-policy override (legacy `image.workspaceMount`\n * included), or null when the office follows the global default.\n */\nexport function loadConversationWorkspaceOverride(office: Office): WorkspacePolicyChoice | null {\n  const file = loadSettingsFile(conversationSettingsPath(office));\n  const sandbox = file?.sandbox;\n  if (sandbox?.workspace?.doorPolicy === \"isolated\") return { doorPolicy: \"isolated\" };\n  if (sandbox?.workspace?.doorPolicy === \"trusted\") {\n    return {\n      doorPolicy: \"trusted\",\n      layout: sandbox.workspace.layout === \"full\" ? \"full\" : \"shared-support\",\n    };\n  }\n  if (sandbox?.image?.workspaceMount === \"full\") return { doorPolicy: \"trusted\", layout: \"full\" };\n  if (sandbox?.image?.workspaceMount === \"private\") {\n    return { doorPolicy: \"trusted\", layout: \"shared-support\" };\n  }\n  return null;\n}\n\nexport function setConversationWorkspacePolicy(\n  office: Office,\n  choice: WorkspacePolicyChoice | null,\n): void {\n  writeWorkspacePolicy(conversationSettingsPath(office), choice, {});\n}\n\nexport function setGlobalWorkspacePolicy(choice: WorkspacePolicyChoice | null): void {\n  writeWorkspacePolicy(join(getStateDir(), \"settings.json\"), choice, ONBOARD_SETTINGS);\n}\n\n/**\n * The generic settings patch merges leaves and cannot remove keys, so the\n * door-policy writer edits the file shape directly: it always drops the\n * legacy `image.workspaceMount` (the explicit choice replaces it) and either\n * sets or removes the `workspace` group.\n */\nfunction writeWorkspacePolicy(\n  settingsPath: string,\n  choice: WorkspacePolicyChoice | null,\n  defaultSettings: SettingsFileConfig,\n): void {\n  const existing = loadSettingsFileForUpdate(settingsPath, defaultSettings);\n  const { workspaceMount: _legacy, ...image } = existing.sandbox?.image ?? {};\n  const { workspace: _previous, image: _image, ...sandboxRest } = existing.sandbox ?? {};\n  const sandbox: SandboxSettings = {\n    ...sandboxRest,\n    ...(hasDefinedValue(image) ? { image } : {}),\n    ...(choice ? { workspace: choice } : {}),\n  };\n  ensureDirExists(dirname(settingsPath));\n  atomicWritePrivateFile(\n    settingsPath,\n    JSON.stringify(compactSettingsConfig({ ...existing, sandbox }), null, 2),\n  );\n}\n"]}

package/dist/execution-resolver.d.ts

@@ -1,17 +1,15 @@
+import type { Workspace } from "./office/index.js";
 import { DockerContainerManager } from "./provisioner.js";
 import { type Executor, type SandboxConfig } from "./sandbox/index.js";
 import { type VaultManager } from "./vault/index.js";
-import { readWorkspaceProjectionMode } from "./workspace-projection/index.js";
 export type { ActorContext } from "./types.js";
 import type { ActorContext } from "./types.js";
-export declare const readConversationWorkspaceMountMode: typeof readWorkspaceProjectionMode;
 export declare class ActorExecutionResolver {
     private baseConfig;
     private vaultManager;
-    private provisioner?;
-    private workspaceDir?;
-    private hostWorkspacePath?;
-    constructor(baseConfig: SandboxConfig, vaultManager: VaultManager, provisioner?: DockerContainerManager | undefined, workspaceDir?: string | undefined, hostWorkspacePath?: string | undefined);
+    private provisioner;
+    private workspace;
+    constructor(baseConfig: SandboxConfig, vaultManager: VaultManager, provisioner: DockerContainerManager | undefined, workspace: Workspace);
     resolve(context: ActorContext): Promise<Executor>;
     private resolvePlan;
     private ensureDefaultSharedVault;

package/dist/execution-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-resolver.d.ts","sourceRoot":"","sources":["../src/execution-resolver.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,sBAAsB,EAAuB,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAIL,KAAK,QAAQ,EACb,KAAK,aAAa,EACnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAA4B,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAS/E,OAAO,EAEL,2BAA2B,EAC5B,MAAM,iCAAiC,CAAC;AAEzC,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,YAAY,CAAC;AAE9D,eAAO,MAAM,kCAAkC,oCAA8B,CAAC;AAE9E,qBAAa,sBAAsB;IAE/B,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,WAAW,CAAC;IACpB,OAAO,CAAC,YAAY,CAAC;IACrB,OAAO,CAAC,iBAAiB,CAAC;IAL5B,YACU,UAAU,EAAE,aAAa,EACzB,YAAY,EAAE,YAAY,EAC1B,WAAW,CAAC,EAAE,sBAAsB,YAAA,EACpC,YAAY,CAAC,EAAE,MAAM,YAAA,EACrB,iBAAiB,CAAC,EAAE,MAAM,YAAA,EAChC;IAEE,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAOtD;IAED,OAAO,CAAC,WAAW;IAqCnB,OAAO,CAAC,wBAAwB;IAuBhC,OAAO,CAAC,oBAAoB;IAuB5B,OAAO,CAAC,wBAAwB;IA0ChC,OAAO,CAAC,aAAa;CAuCtB"}
+{"version":3,"file":"execution-resolver.d.ts","sourceRoot":"","sources":["../src/execution-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAU,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAG3D,OAAO,EAAE,sBAAsB,EAAuB,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAIL,KAAK,QAAQ,EACb,KAAK,aAAa,EACnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAA4B,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAW/E,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,YAAY,CAAC;AAE9D,qBAAa,sBAAsB;IAE/B,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,SAAS;IAJnB,YACU,UAAU,EAAE,aAAa,EACzB,YAAY,EAAE,YAAY,EAC1B,WAAW,EAAE,sBAAsB,GAAG,SAAS,EAC/C,SAAS,EAAE,SAAS,EAC1B;IAEE,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAOtD;IAED,OAAO,CAAC,WAAW;IAsCnB,OAAO,CAAC,wBAAwB;IAuBhC,OAAO,CAAC,oBAAoB;IAuB5B,OAAO,CAAC,wBAAwB;IA0ChC,OAAO,CAAC,aAAa;CAiCtB"}

package/dist/execution-resolver.js

@@ -1,6 +1,4 @@
 import { posix } from "node:path";
-import { effectiveStateDir } from "./cli/arg-grammar.js";
-import { conversationOfficeDir } from "./office-address.js";
 import { conversationPackageSkillMounts } from "./packages/index.js";
 import { loadGlobalSettings } from "./config.js";
 import { DockerContainerManager } from "./provisioner.js";
@@ -10,15 +8,13 @@ import { normalizeSharedVaultName } from "./vault/index.js";
 import { resolveVaultInjection } from "./vault/injection.js";
 import { allowsAmbientDefaultSharedVault } from "./vault/policy.js";
 import { credentialAuthorizationKey, legacyExactCredentialAuthorizationKey, runtimeResourceKey, scopeCloudflareSandboxId, } from "./sandbox/identity.js";
-import { resolveWorkspaceProjection, readWorkspaceProjectionMode, } from "./workspace-projection/index.js";
-export const readConversationWorkspaceMountMode = readWorkspaceProjectionMode;
+import { resolveWorkspaceProjection } from "./workspace-projection/index.js";
 export class ActorExecutionResolver {
-    constructor(baseConfig, vaultManager, provisioner, workspaceDir, hostWorkspacePath) {
+    constructor(baseConfig, vaultManager, provisioner, workspace) {
         this.baseConfig = baseConfig;
         this.vaultManager = vaultManager;
         this.provisioner = provisioner;
-        this.workspaceDir = workspaceDir;
-        this.hostWorkspacePath = hostWorkspacePath;
+        this.workspace = workspace;
     }
     async resolve(context) {
         const plan = this.resolvePlan(context);
@@ -37,14 +33,15 @@ export class ActorExecutionResolver {
             (legacyCredentialKey ? this.vaultManager.resolve(legacyCredentialKey) : undefined);
         const capabilities = getSandboxCredentialCapabilities(this.baseConfig.type);
         const workspaceCapabilities = getSandboxWorkspaceCapabilities(this.baseConfig.type);
-        const workspaceProjection = resolveWorkspaceProjection(this.workspaceDir, context.address);
+        const office = this.workspace.office(context.address);
+        const workspaceProjection = resolveWorkspaceProjection(office);
         const injection = resolveVaultInjection({
             vault,
             capabilities,
             sandboxType: this.baseConfig.type,
-            conversationId: context.address.conversationId,
+            address: office.address,
         });
-        const mounts = this.resolveMounts(context.address, injection.mounts, workspaceProjection);
+        const mounts = this.resolveMounts(office, injection.mounts, workspaceProjection);
         if (workspaceProjection.doorPolicy === "isolated" && !workspaceCapabilities.managedProjection) {
             throw new Error(`Sandbox '${this.baseConfig.type}' cannot provide an isolated conversation office; use image:* or gondolin:default, or explicitly choose trusted workspace policy`);
         }
@@ -84,7 +81,7 @@ export class ActorExecutionResolver {
         if (this.baseConfig.type === "gondolin") {
             return {
                 ...this.baseConfig,
-                workspacePath: this.hostWorkspacePath,
+                workspacePath: this.workspace.root,
                 mounts,
                 instanceId: resourceKey,
                 resourceKey,
@@ -133,18 +130,12 @@ export class ActorExecutionResolver {
             }
         };
     }
-    resolveMounts(address, vaultMounts, projection) {
+    resolveMounts(office, vaultMounts, projection) {
         const workspaceMounts = projection.mounts;
         // Package skills mount outside /workspace, so they cannot collide with the
         // workspace projection; they are still checked against vault mounts below,
         // which are administrator-chosen targets and could be aimed anywhere.
-        const packageMounts = this.workspaceDir
-            ? conversationPackageSkillMounts({
-                address,
-                stateDir: effectiveStateDir(),
-                conversationDir: conversationOfficeDir(this.workspaceDir, address),
-            })
-            : [];
+        const packageMounts = conversationPackageSkillMounts({ office });
         const protectedMounts = [...workspaceMounts, ...packageMounts];
         for (let index = 0; index < vaultMounts.length; index += 1) {
             const vaultMount = vaultMounts[index];

package/dist/execution-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"execution-resolver.js","sourceRoot":"","sources":["../src/execution-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAuB,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EACL,cAAc,EACd,gCAAgC,EAChC,+BAA+B,GAGhC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAqB,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EACL,0BAA0B,EAC1B,qCAAqC,EACrC,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,iCAAiC,CAAC;AAKzC,MAAM,CAAC,MAAM,kCAAkC,GAAG,2BAA2B,CAAC;AAE9E,MAAM,OAAO,sBAAsB;IACjC,YACU,UAAyB,EACzB,YAA0B,EAC1B,WAAoC,EACpC,YAAqB,EACrB,iBAA0B;0BAJ1B,UAAU;4BACV,YAAY;2BACZ,WAAW;4BACX,YAAY;iCACZ,iBAAiB;IACxB,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,OAAqB;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACvC,OAAO,cAAc,CACnB,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CACpE,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,OAAqB;QACvC,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QACnE,MAAM,aAAa,GAAG,0BAA0B,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACzE,MAAM,mBAAmB,GAAG,qCAAqC,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC1F,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE;YACtD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc;SAC/C,CAAC,CAAC;QACH,IAAI,CAAC,wBAAwB,CAAC,aAAa,EAAE,mBAAmB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAEtF,MAAM,KAAK,GACT,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC;YACxC,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrF,MAAM,YAAY,GAAG,gCAAgC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC5E,MAAM,qBAAqB,GAAG,+BAA+B,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpF,MAAM,mBAAmB,GAAG,0BAA0B,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3F,MAAM,SAAS,GAAG,qBAAqB,CAAC;YACtC,KAAK;YACL,YAAY;YACZ,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YACjC,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc;SAC/C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;QAC1F,IAAI,mBAAmB,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,qBAAqB,CAAC,iBAAiB,EAAE,CAAC;YAC9F,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,CAAC,UAAU,CAAC,IAAI,kIAAkI,CACnK,CAAC;QACJ,CAAC;QACD,OAAO;YACL,aAAa;YACb,WAAW;YACX,aAAa,EAAE,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,MAAM,CAAC;YAC7D,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,MAAM;SACP,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAC9B,aAAqB,EACrB,mBAAuC,EACvC,UAAsC;QAEtC,IAAI,CAAC,+BAA+B,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO;QAChG,IACE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC;YACzC,CAAC,mBAAmB,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,EACxE,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACH,OAAO,GAAG,kBAAkB,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,wBAAwB,CAAC,OAAO,CAAC,KAAK,OAAO;YAAE,OAAO;QACtE,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC9D,CAAC;IAEO,oBAAoB,CAAC,WAAmB,EAAE,MAAwB;QACxE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC1C,OAAO;gBACL,IAAI,EAAE,YAAY;gBAClB,SAAS,EAAE,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC;aAC5E,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACxC,OAAO;gBACL,GAAG,IAAI,CAAC,UAAU;gBAClB,aAAa,EAAE,IAAI,CAAC,iBAAiB;gBACrC,MAAM;gBACN,UAAU,EAAE,WAAW;gBACvB,WAAW;aACZ,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAC7D,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,sBAAsB,CAAC,aAAa,CAAC,WAAW,CAAC;SAC7D,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAC9B,IAAmB,EACnB,cAAsB;QAEtB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,KAAK,IAAI,EAAE;YAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE;oBAC3D,aAAa,EAAE,QAAQ;oBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qBAAqB,CAAC,GAAG,EAAE;oBACzB,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,mBAAmB;oBAC5B,SAAS,EAAE,8BAA8B;oBACzC,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE;wBACP,WAAW,EAAE,OAAO;wBACpB,cAAc;wBACd,aAAa,EAAE,IAAI,CAAC,aAAa;wBACjC,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,iBAAiB,EAAE,QAAQ;wBAC3B,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;qBACtD;iBACF,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,MAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,uBAAuB,IAAI,CAAC,WAAW,gBAAgB,QAAQ,GAAG,CAC5G,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAEO,aAAa,CACnB,OAAgC,EAChC,WAA6B,EAC7B,UAAyD;QAEzD,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC;QAC1C,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY;YACrC,CAAC,CAAC,8BAA8B,CAAC;gBAC7B,OAAO;gBACP,QAAQ,EAAE,iBAAiB,EAAE;gBAC7B,eAAe,EAAE,qBAAqB,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC;aACnE,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,eAAe,GAAG,CAAC,GAAG,eAAe,EAAE,GAAG,aAAa,CAAC,CAAC;QAC/D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC3D,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YACtC,MAAM,kBAAkB,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,CACjE,cAAc,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CACzD,CAAC;YACF,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,uBAAuB,UAAU,CAAC,MAAM,0CAA0C,kBAAkB,CAAC,MAAM,GAAG,CAC/G,CAAC;YACJ,CAAC;YAED,MAAM,cAAc,GAAG,WAAW;iBAC/B,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;iBACf,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YACpE,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CACb,uBAAuB,UAAU,CAAC,MAAM,4BAA4B,cAAc,CAAC,MAAM,GAAG,CAC7F,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,eAAe,EAAE,GAAG,WAAW,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa;IACjD,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;AAC/C,CAAC","sourcesContent":["import { posix } from \"node:path\";\nimport { effectiveStateDir } from \"./cli/arg-grammar.js\";\nimport { conversationOfficeDir } from \"./office-address.js\";\nimport { conversationPackageSkillMounts } from \"./packages/index.js\";\nimport { loadGlobalSettings } from \"./config.js\";\nimport { DockerContainerManager, type ContainerMount } from \"./provisioner.js\";\nimport {\n  createExecutor,\n  getSandboxCredentialCapabilities,\n  getSandboxWorkspaceCapabilities,\n  type Executor,\n  type SandboxConfig,\n} from \"./sandbox/index.js\";\nimport { reportUserFacingError } from \"./observability/sentry.js\";\nimport { normalizeSharedVaultName, type VaultManager } from \"./vault/index.js\";\nimport { resolveVaultInjection } from \"./vault/injection.js\";\nimport { allowsAmbientDefaultSharedVault } from \"./vault/policy.js\";\nimport {\n  credentialAuthorizationKey,\n  legacyExactCredentialAuthorizationKey,\n  runtimeResourceKey,\n  scopeCloudflareSandboxId,\n} from \"./sandbox/identity.js\";\nimport {\n  resolveWorkspaceProjection,\n  readWorkspaceProjectionMode,\n} from \"./workspace-projection/index.js\";\n\nexport type { ActorContext } from \"./types.js\";\nimport type { ActorContext, ExecutionPlan } from \"./types.js\";\n\nexport const readConversationWorkspaceMountMode = readWorkspaceProjectionMode;\n\nexport class ActorExecutionResolver {\n  constructor(\n    private baseConfig: SandboxConfig,\n    private vaultManager: VaultManager,\n    private provisioner?: DockerContainerManager,\n    private workspaceDir?: string,\n    private hostWorkspacePath?: string,\n  ) {}\n\n  async resolve(context: ActorContext): Promise<Executor> {\n    const plan = this.resolvePlan(context);\n    return createExecutor(\n      plan.sandboxConfig,\n      plan.env,\n      this.buildEnsureReadyCallback(plan, context.address.conversationId),\n    );\n  }\n\n  private resolvePlan(context: ActorContext): ExecutionPlan {\n    const scope = { userId: context.userId, address: context.address };\n    const credentialKey = credentialAuthorizationKey(this.baseConfig, scope);\n    const legacyCredentialKey = legacyExactCredentialAuthorizationKey(this.baseConfig, scope);\n    const resourceKey = runtimeResourceKey(this.baseConfig, {\n      userId: context.userId,\n      conversationId: context.address.conversationId,\n    });\n    this.ensureDefaultSharedVault(credentialKey, legacyCredentialKey, context.trustModel);\n\n    const vault =\n      this.vaultManager.resolve(credentialKey) ??\n      (legacyCredentialKey ? this.vaultManager.resolve(legacyCredentialKey) : undefined);\n    const capabilities = getSandboxCredentialCapabilities(this.baseConfig.type);\n    const workspaceCapabilities = getSandboxWorkspaceCapabilities(this.baseConfig.type);\n    const workspaceProjection = resolveWorkspaceProjection(this.workspaceDir, context.address);\n    const injection = resolveVaultInjection({\n      vault,\n      capabilities,\n      sandboxType: this.baseConfig.type,\n      conversationId: context.address.conversationId,\n    });\n    const mounts = this.resolveMounts(context.address, injection.mounts, workspaceProjection);\n    if (workspaceProjection.doorPolicy === \"isolated\" && !workspaceCapabilities.managedProjection) {\n      throw new Error(\n        `Sandbox '${this.baseConfig.type}' cannot provide an isolated conversation office; use image:* or gondolin:default, or explicitly choose trusted workspace policy`,\n      );\n    }\n    return {\n      credentialKey,\n      resourceKey,\n      sandboxConfig: this.resolveSandboxConfig(resourceKey, mounts),\n      env: injection.env,\n      mounts,\n    };\n  }\n\n  private ensureDefaultSharedVault(\n    credentialKey: string,\n    legacyCredentialKey: string | undefined,\n    trustModel: ActorContext[\"trustModel\"],\n  ): void {\n    if (!allowsAmbientDefaultSharedVault({ trustModel, sandboxType: this.baseConfig.type })) return;\n    if (\n      this.vaultManager.hasEntry(credentialKey) ||\n      (legacyCredentialKey && this.vaultManager.hasEntry(legacyCredentialKey))\n    ) {\n      return;\n    }\n\n    let profile: string | undefined;\n    try {\n      profile = loadGlobalSettings().sandbox?.defaultSharedVault;\n    } catch {\n      return;\n    }\n    if (!profile || normalizeSharedVaultName(profile) !== profile) return;\n    this.vaultManager.copySharedVaultTo(profile, credentialKey);\n  }\n\n  private resolveSandboxConfig(resourceKey: string, mounts: ContainerMount[]): SandboxConfig {\n    if (this.baseConfig.type === \"cloudflare\") {\n      return {\n        type: \"cloudflare\",\n        sandboxId: scopeCloudflareSandboxId(this.baseConfig.sandboxId, resourceKey),\n      };\n    }\n    if (this.baseConfig.type === \"gondolin\") {\n      return {\n        ...this.baseConfig,\n        workspacePath: this.hostWorkspacePath,\n        mounts,\n        instanceId: resourceKey,\n        resourceKey,\n      };\n    }\n    if (this.baseConfig.type !== \"image\") return this.baseConfig;\n    return {\n      type: \"container\",\n      container: DockerContainerManager.containerName(resourceKey),\n    };\n  }\n\n  private buildEnsureReadyCallback(\n    plan: ExecutionPlan,\n    conversationId: string,\n  ): (() => Promise<void>) | undefined {\n    if (this.baseConfig.type !== \"image\" || plan.sandboxConfig.type !== \"container\") {\n      return undefined;\n    }\n\n    return async () => {\n      const expected = plan.sandboxConfig.type === \"container\" ? plan.sandboxConfig.container : \"\";\n      let actual: string | undefined;\n      try {\n        actual = await this.provisioner?.provision(plan.resourceKey, {\n          containerName: expected,\n          mounts: plan.mounts,\n          conversationId,\n        });\n      } catch (err) {\n        reportUserFacingError(err, {\n          domain: \"sandbox\",\n          surface: \"sandbox_provision\",\n          operation: \"ensure_image_container_ready\",\n          severity: \"error\",\n          context: {\n            sandboxType: \"image\",\n            conversationId,\n            credentialKey: plan.credentialKey,\n            resourceKey: plan.resourceKey,\n            expectedContainer: expected,\n            hasVault: Boolean(plan.env || plan.mounts.length > 0),\n          },\n        });\n        throw err;\n      }\n      if (actual && actual !== expected) {\n        throw new Error(\n          `Provisioner returned container \"${actual}\" for resource key \"${plan.resourceKey}\", expected \"${expected}\"`,\n        );\n      }\n    };\n  }\n\n  private resolveMounts(\n    address: ActorContext[\"address\"],\n    vaultMounts: ContainerMount[],\n    projection: ReturnType<typeof resolveWorkspaceProjection>,\n  ): ContainerMount[] {\n    const workspaceMounts = projection.mounts;\n    // Package skills mount outside /workspace, so they cannot collide with the\n    // workspace projection; they are still checked against vault mounts below,\n    // which are administrator-chosen targets and could be aimed anywhere.\n    const packageMounts = this.workspaceDir\n      ? conversationPackageSkillMounts({\n          address,\n          stateDir: effectiveStateDir(),\n          conversationDir: conversationOfficeDir(this.workspaceDir, address),\n        })\n      : [];\n    const protectedMounts = [...workspaceMounts, ...packageMounts];\n    for (let index = 0; index < vaultMounts.length; index += 1) {\n      const vaultMount = vaultMounts[index];\n      const workspaceCollision = protectedMounts.find((protectedMount) =>\n        targetsOverlap(protectedMount.target, vaultMount.target),\n      );\n      if (workspaceCollision) {\n        throw new Error(\n          `Vault mount target \"${vaultMount.target}\" overlaps protected workspace target \"${workspaceCollision.target}\"`,\n        );\n      }\n\n      const vaultCollision = vaultMounts\n        .slice(0, index)\n        .find((other) => targetsOverlap(other.target, vaultMount.target));\n      if (vaultCollision) {\n        throw new Error(\n          `Vault mount target \"${vaultMount.target}\" overlaps vault target \"${vaultCollision.target}\"`,\n        );\n      }\n    }\n    return [...protectedMounts, ...vaultMounts];\n  }\n}\n\nfunction targetsOverlap(left: string, right: string): boolean {\n  const a = normalizeMountTarget(left);\n  const b = normalizeMountTarget(right);\n  return a === b || a.startsWith(`${b}/`) || b.startsWith(`${a}/`);\n}\n\nfunction normalizeMountTarget(value: string): string {\n  const normalized = posix.normalize(value);\n  return normalized.replace(/\\/+$/, \"\") || \"/\";\n}\n"]}
+{"version":3,"file":"execution-resolver.js","sourceRoot":"","sources":["../src/execution-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAuB,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EACL,cAAc,EACd,gCAAgC,EAChC,+BAA+B,GAGhC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAqB,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EACL,0BAA0B,EAC1B,qCAAqC,EACrC,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAK7E,MAAM,OAAO,sBAAsB;IACjC,YACU,UAAyB,EACzB,YAA0B,EAC1B,WAA+C,EAC/C,SAAoB;0BAHpB,UAAU;4BACV,YAAY;2BACZ,WAAW;yBACX,SAAS;IAChB,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,OAAqB;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACvC,OAAO,cAAc,CACnB,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CACpE,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,OAAqB;QACvC,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QACnE,MAAM,aAAa,GAAG,0BAA0B,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACzE,MAAM,mBAAmB,GAAG,qCAAqC,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC1F,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE;YACtD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc;SAC/C,CAAC,CAAC;QACH,IAAI,CAAC,wBAAwB,CAAC,aAAa,EAAE,mBAAmB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAEtF,MAAM,KAAK,GACT,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC;YACxC,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrF,MAAM,YAAY,GAAG,gCAAgC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC5E,MAAM,qBAAqB,GAAG,+BAA+B,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,mBAAmB,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,qBAAqB,CAAC;YACtC,KAAK;YACL,YAAY;YACZ,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YACjC,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;QACjF,IAAI,mBAAmB,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,qBAAqB,CAAC,iBAAiB,EAAE,CAAC;YAC9F,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,CAAC,UAAU,CAAC,IAAI,kIAAkI,CACnK,CAAC;QACJ,CAAC;QACD,OAAO;YACL,aAAa;YACb,WAAW;YACX,aAAa,EAAE,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,MAAM,CAAC;YAC7D,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,MAAM;SACP,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAC9B,aAAqB,EACrB,mBAAuC,EACvC,UAAsC;QAEtC,IAAI,CAAC,+BAA+B,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO;QAChG,IACE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC;YACzC,CAAC,mBAAmB,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,EACxE,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACH,OAAO,GAAG,kBAAkB,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,wBAAwB,CAAC,OAAO,CAAC,KAAK,OAAO;YAAE,OAAO;QACtE,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC9D,CAAC;IAEO,oBAAoB,CAAC,WAAmB,EAAE,MAAwB;QACxE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC1C,OAAO;gBACL,IAAI,EAAE,YAAY;gBAClB,SAAS,EAAE,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC;aAC5E,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACxC,OAAO;gBACL,GAAG,IAAI,CAAC,UAAU;gBAClB,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI;gBAClC,MAAM;gBACN,UAAU,EAAE,WAAW;gBACvB,WAAW;aACZ,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAC7D,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,sBAAsB,CAAC,aAAa,CAAC,WAAW,CAAC;SAC7D,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAC9B,IAAmB,EACnB,cAAsB;QAEtB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,KAAK,IAAI,EAAE;YAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE;oBAC3D,aAAa,EAAE,QAAQ;oBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qBAAqB,CAAC,GAAG,EAAE;oBACzB,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,mBAAmB;oBAC5B,SAAS,EAAE,8BAA8B;oBACzC,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE;wBACP,WAAW,EAAE,OAAO;wBACpB,cAAc;wBACd,aAAa,EAAE,IAAI,CAAC,aAAa;wBACjC,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,iBAAiB,EAAE,QAAQ;wBAC3B,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;qBACtD;iBACF,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,MAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,uBAAuB,IAAI,CAAC,WAAW,gBAAgB,QAAQ,GAAG,CAC5G,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAEO,aAAa,CACnB,MAAc,EACd,WAA6B,EAC7B,UAAyD;QAEzD,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC;QAC1C,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,MAAM,aAAa,GAAG,8BAA8B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,MAAM,eAAe,GAAG,CAAC,GAAG,eAAe,EAAE,GAAG,aAAa,CAAC,CAAC;QAC/D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC3D,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YACtC,MAAM,kBAAkB,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,CACjE,cAAc,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CACzD,CAAC;YACF,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,uBAAuB,UAAU,CAAC,MAAM,0CAA0C,kBAAkB,CAAC,MAAM,GAAG,CAC/G,CAAC;YACJ,CAAC;YAED,MAAM,cAAc,GAAG,WAAW;iBAC/B,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;iBACf,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YACpE,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CACb,uBAAuB,UAAU,CAAC,MAAM,4BAA4B,cAAc,CAAC,MAAM,GAAG,CAC7F,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,eAAe,EAAE,GAAG,WAAW,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa;IACjD,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;AAC/C,CAAC","sourcesContent":["import { posix } from \"node:path\";\nimport type { Office, Workspace } from \"./office/index.js\";\nimport { conversationPackageSkillMounts } from \"./packages/index.js\";\nimport { loadGlobalSettings } from \"./config.js\";\nimport { DockerContainerManager, type ContainerMount } from \"./provisioner.js\";\nimport {\n  createExecutor,\n  getSandboxCredentialCapabilities,\n  getSandboxWorkspaceCapabilities,\n  type Executor,\n  type SandboxConfig,\n} from \"./sandbox/index.js\";\nimport { reportUserFacingError } from \"./observability/sentry.js\";\nimport { normalizeSharedVaultName, type VaultManager } from \"./vault/index.js\";\nimport { resolveVaultInjection } from \"./vault/injection.js\";\nimport { allowsAmbientDefaultSharedVault } from \"./vault/policy.js\";\nimport {\n  credentialAuthorizationKey,\n  legacyExactCredentialAuthorizationKey,\n  runtimeResourceKey,\n  scopeCloudflareSandboxId,\n} from \"./sandbox/identity.js\";\nimport { resolveWorkspaceProjection } from \"./workspace-projection/index.js\";\n\nexport type { ActorContext } from \"./types.js\";\nimport type { ActorContext, ExecutionPlan } from \"./types.js\";\n\nexport class ActorExecutionResolver {\n  constructor(\n    private baseConfig: SandboxConfig,\n    private vaultManager: VaultManager,\n    private provisioner: DockerContainerManager | undefined,\n    private workspace: Workspace,\n  ) {}\n\n  async resolve(context: ActorContext): Promise<Executor> {\n    const plan = this.resolvePlan(context);\n    return createExecutor(\n      plan.sandboxConfig,\n      plan.env,\n      this.buildEnsureReadyCallback(plan, context.address.conversationId),\n    );\n  }\n\n  private resolvePlan(context: ActorContext): ExecutionPlan {\n    const scope = { userId: context.userId, address: context.address };\n    const credentialKey = credentialAuthorizationKey(this.baseConfig, scope);\n    const legacyCredentialKey = legacyExactCredentialAuthorizationKey(this.baseConfig, scope);\n    const resourceKey = runtimeResourceKey(this.baseConfig, {\n      userId: context.userId,\n      conversationId: context.address.conversationId,\n    });\n    this.ensureDefaultSharedVault(credentialKey, legacyCredentialKey, context.trustModel);\n\n    const vault =\n      this.vaultManager.resolve(credentialKey) ??\n      (legacyCredentialKey ? this.vaultManager.resolve(legacyCredentialKey) : undefined);\n    const capabilities = getSandboxCredentialCapabilities(this.baseConfig.type);\n    const workspaceCapabilities = getSandboxWorkspaceCapabilities(this.baseConfig.type);\n    const office = this.workspace.office(context.address);\n    const workspaceProjection = resolveWorkspaceProjection(office);\n    const injection = resolveVaultInjection({\n      vault,\n      capabilities,\n      sandboxType: this.baseConfig.type,\n      address: office.address,\n    });\n    const mounts = this.resolveMounts(office, injection.mounts, workspaceProjection);\n    if (workspaceProjection.doorPolicy === \"isolated\" && !workspaceCapabilities.managedProjection) {\n      throw new Error(\n        `Sandbox '${this.baseConfig.type}' cannot provide an isolated conversation office; use image:* or gondolin:default, or explicitly choose trusted workspace policy`,\n      );\n    }\n    return {\n      credentialKey,\n      resourceKey,\n      sandboxConfig: this.resolveSandboxConfig(resourceKey, mounts),\n      env: injection.env,\n      mounts,\n    };\n  }\n\n  private ensureDefaultSharedVault(\n    credentialKey: string,\n    legacyCredentialKey: string | undefined,\n    trustModel: ActorContext[\"trustModel\"],\n  ): void {\n    if (!allowsAmbientDefaultSharedVault({ trustModel, sandboxType: this.baseConfig.type })) return;\n    if (\n      this.vaultManager.hasEntry(credentialKey) ||\n      (legacyCredentialKey && this.vaultManager.hasEntry(legacyCredentialKey))\n    ) {\n      return;\n    }\n\n    let profile: string | undefined;\n    try {\n      profile = loadGlobalSettings().sandbox?.defaultSharedVault;\n    } catch {\n      return;\n    }\n    if (!profile || normalizeSharedVaultName(profile) !== profile) return;\n    this.vaultManager.copySharedVaultTo(profile, credentialKey);\n  }\n\n  private resolveSandboxConfig(resourceKey: string, mounts: ContainerMount[]): SandboxConfig {\n    if (this.baseConfig.type === \"cloudflare\") {\n      return {\n        type: \"cloudflare\",\n        sandboxId: scopeCloudflareSandboxId(this.baseConfig.sandboxId, resourceKey),\n      };\n    }\n    if (this.baseConfig.type === \"gondolin\") {\n      return {\n        ...this.baseConfig,\n        workspacePath: this.workspace.root,\n        mounts,\n        instanceId: resourceKey,\n        resourceKey,\n      };\n    }\n    if (this.baseConfig.type !== \"image\") return this.baseConfig;\n    return {\n      type: \"container\",\n      container: DockerContainerManager.containerName(resourceKey),\n    };\n  }\n\n  private buildEnsureReadyCallback(\n    plan: ExecutionPlan,\n    conversationId: string,\n  ): (() => Promise<void>) | undefined {\n    if (this.baseConfig.type !== \"image\" || plan.sandboxConfig.type !== \"container\") {\n      return undefined;\n    }\n\n    return async () => {\n      const expected = plan.sandboxConfig.type === \"container\" ? plan.sandboxConfig.container : \"\";\n      let actual: string | undefined;\n      try {\n        actual = await this.provisioner?.provision(plan.resourceKey, {\n          containerName: expected,\n          mounts: plan.mounts,\n          conversationId,\n        });\n      } catch (err) {\n        reportUserFacingError(err, {\n          domain: \"sandbox\",\n          surface: \"sandbox_provision\",\n          operation: \"ensure_image_container_ready\",\n          severity: \"error\",\n          context: {\n            sandboxType: \"image\",\n            conversationId,\n            credentialKey: plan.credentialKey,\n            resourceKey: plan.resourceKey,\n            expectedContainer: expected,\n            hasVault: Boolean(plan.env || plan.mounts.length > 0),\n          },\n        });\n        throw err;\n      }\n      if (actual && actual !== expected) {\n        throw new Error(\n          `Provisioner returned container \"${actual}\" for resource key \"${plan.resourceKey}\", expected \"${expected}\"`,\n        );\n      }\n    };\n  }\n\n  private resolveMounts(\n    office: Office,\n    vaultMounts: ContainerMount[],\n    projection: ReturnType<typeof resolveWorkspaceProjection>,\n  ): ContainerMount[] {\n    const workspaceMounts = projection.mounts;\n    // Package skills mount outside /workspace, so they cannot collide with the\n    // workspace projection; they are still checked against vault mounts below,\n    // which are administrator-chosen targets and could be aimed anywhere.\n    const packageMounts = conversationPackageSkillMounts({ office });\n    const protectedMounts = [...workspaceMounts, ...packageMounts];\n    for (let index = 0; index < vaultMounts.length; index += 1) {\n      const vaultMount = vaultMounts[index];\n      const workspaceCollision = protectedMounts.find((protectedMount) =>\n        targetsOverlap(protectedMount.target, vaultMount.target),\n      );\n      if (workspaceCollision) {\n        throw new Error(\n          `Vault mount target \"${vaultMount.target}\" overlaps protected workspace target \"${workspaceCollision.target}\"`,\n        );\n      }\n\n      const vaultCollision = vaultMounts\n        .slice(0, index)\n        .find((other) => targetsOverlap(other.target, vaultMount.target));\n      if (vaultCollision) {\n        throw new Error(\n          `Vault mount target \"${vaultMount.target}\" overlaps vault target \"${vaultCollision.target}\"`,\n        );\n      }\n    }\n    return [...protectedMounts, ...vaultMounts];\n  }\n}\n\nfunction targetsOverlap(left: string, right: string): boolean {\n  const a = normalizeMountTarget(left);\n  const b = normalizeMountTarget(right);\n  return a === b || a.startsWith(`${b}/`) || b.startsWith(`${a}/`);\n}\n\nfunction normalizeMountTarget(value: string): string {\n  const normalized = posix.normalize(value);\n  return normalized.replace(/\\/+$/, \"\") || \"/\";\n}\n"]}

package/dist/harness/extensions/loader.js

@@ -31,7 +31,7 @@ import { buildEventPayload } from "../event-format.js";
 import { loadSkillsFromDir } from "../skills.js";
 import { namespaceActionIds } from "./blockkit.js";
 import { ExtensionRegistry } from "./registry.js";
-import { officeStateDir } from "../../office-address.js";
+import { officeStateDir } from "../../office/index.js";
 const EXTENSION_FILE_PATTERN = /\.(mjs|js|ts|mts)$/;
 const INDEX_FILE_PATTERN = /^index\.(mjs|js|ts|mts)$/;
 const INDEX_CANDIDATES = ["index.mjs", "index.js", "index.ts", "index.mts"];